net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   14
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_BONDABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81         MGMT_OP_SET_DEVICE_ID,
  82         MGMT_OP_SET_ADVERTISING,
  83         MGMT_OP_SET_BREDR,
  84         MGMT_OP_SET_STATIC_ADDRESS,
  85         MGMT_OP_SET_SCAN_PARAMS,
  86         MGMT_OP_SET_SECURE_CONN,
  87         MGMT_OP_SET_DEBUG_KEYS,
  88         MGMT_OP_SET_PRIVACY,
  89         MGMT_OP_LOAD_IRKS,
  90         MGMT_OP_GET_CONN_INFO,
  91         MGMT_OP_GET_CLOCK_INFO,
  92         MGMT_OP_ADD_DEVICE,
  93         MGMT_OP_REMOVE_DEVICE,
  94         MGMT_OP_LOAD_CONN_PARAM,
  95         MGMT_OP_READ_UNCONF_INDEX_LIST,
  96         MGMT_OP_READ_CONFIG_INFO,
  97         MGMT_OP_SET_EXTERNAL_CONFIG,
  98         MGMT_OP_SET_PUBLIC_ADDRESS,
  99         MGMT_OP_START_SERVICE_DISCOVERY,
 100         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 101         MGMT_OP_READ_EXT_INDEX_LIST,
 102         MGMT_OP_READ_ADV_FEATURES,
 103         MGMT_OP_ADD_ADVERTISING,
 104         MGMT_OP_REMOVE_ADVERTISING,
 105         MGMT_OP_GET_ADV_SIZE_INFO,
 106         MGMT_OP_START_LIMITED_DISCOVERY,
 107         MGMT_OP_READ_EXT_INFO,
 108         MGMT_OP_SET_APPEARANCE,
 109 };
 110
 111 static const u16 mgmt_events[] = {
 112         MGMT_EV_CONTROLLER_ERROR,
 113         MGMT_EV_INDEX_ADDED,
 114         MGMT_EV_INDEX_REMOVED,
 115         MGMT_EV_NEW_SETTINGS,
 116         MGMT_EV_CLASS_OF_DEV_CHANGED,
 117         MGMT_EV_LOCAL_NAME_CHANGED,
 118         MGMT_EV_NEW_LINK_KEY,
 119         MGMT_EV_NEW_LONG_TERM_KEY,
 120         MGMT_EV_DEVICE_CONNECTED,
 121         MGMT_EV_DEVICE_DISCONNECTED,
 122         MGMT_EV_CONNECT_FAILED,
 123         MGMT_EV_PIN_CODE_REQUEST,
 124         MGMT_EV_USER_CONFIRM_REQUEST,
 125         MGMT_EV_USER_PASSKEY_REQUEST,
 126         MGMT_EV_AUTH_FAILED,
 127         MGMT_EV_DEVICE_FOUND,
 128         MGMT_EV_DISCOVERING,
 129         MGMT_EV_DEVICE_BLOCKED,
 130         MGMT_EV_DEVICE_UNBLOCKED,
 131         MGMT_EV_DEVICE_UNPAIRED,
 132         MGMT_EV_PASSKEY_NOTIFY,
 133         MGMT_EV_NEW_IRK,
 134         MGMT_EV_NEW_CSRK,
 135         MGMT_EV_DEVICE_ADDED,
 136         MGMT_EV_DEVICE_REMOVED,
 137         MGMT_EV_NEW_CONN_PARAM,
 138         MGMT_EV_UNCONF_INDEX_ADDED,
 139         MGMT_EV_UNCONF_INDEX_REMOVED,
 140         MGMT_EV_NEW_CONFIG_OPTIONS,
 141         MGMT_EV_EXT_INDEX_ADDED,
 142         MGMT_EV_EXT_INDEX_REMOVED,
 143         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 144         MGMT_EV_ADVERTISING_ADDED,
 145         MGMT_EV_ADVERTISING_REMOVED,
 146         MGMT_EV_EXT_INFO_CHANGED,
 147 };
 148
 149 static const u16 mgmt_untrusted_commands[] = {
 150         MGMT_OP_READ_INDEX_LIST,
 151         MGMT_OP_READ_INFO,
 152         MGMT_OP_READ_UNCONF_INDEX_LIST,
 153         MGMT_OP_READ_CONFIG_INFO,
 154         MGMT_OP_READ_EXT_INDEX_LIST,
 155         MGMT_OP_READ_EXT_INFO,
 156 };
 157
 158 static const u16 mgmt_untrusted_events[] = {
 159         MGMT_EV_INDEX_ADDED,
 160         MGMT_EV_INDEX_REMOVED,
 161         MGMT_EV_NEW_SETTINGS,
 162         MGMT_EV_CLASS_OF_DEV_CHANGED,
 163         MGMT_EV_LOCAL_NAME_CHANGED,
 164         MGMT_EV_UNCONF_INDEX_ADDED,
 165         MGMT_EV_UNCONF_INDEX_REMOVED,
 166         MGMT_EV_NEW_CONFIG_OPTIONS,
 167         MGMT_EV_EXT_INDEX_ADDED,
 168         MGMT_EV_EXT_INDEX_REMOVED,
 169         MGMT_EV_EXT_INFO_CHANGED,
 170 };
 171
 172 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 173
 174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 175                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 176
 177 /* HCI to MGMT error code conversion table */
 178 static u8 mgmt_status_table[] = {
 179         MGMT_STATUS_SUCCESS,
 180         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 181         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 182         MGMT_STATUS_FAILED,             /* Hardware Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 184         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 185         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 186         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 187         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 188         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 189         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 190         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 191         MGMT_STATUS_BUSY,               /* Command Disallowed */
 192         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 193         MGMT_STATUS_REJECTED,           /* Rejected Security */
 194         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 195         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 196         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 197         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 198         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 199         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 200         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 201         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 202         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 203         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 204         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 205         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 206         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 207         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 208         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 209         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 210         MGMT_STATUS_FAILED,             /* Unspecified Error */
 211         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 212         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 213         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 214         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 215         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 216         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 217         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 218         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 219         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 220         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 221         MGMT_STATUS_FAILED,             /* Transaction Collision */
 222         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 223         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 224         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 225         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 226         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 227         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 228         MGMT_STATUS_FAILED,             /* Slot Violation */
 229         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 230         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 231         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 232         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 233         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 234         MGMT_STATUS_BUSY,               /* Controller Busy */
 235         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 236         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 237         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 238         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 239         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 240 };
 241
 242 static u8 mgmt_status(u8 hci_status)
 243 {
 244         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 245                 return mgmt_status_table[hci_status];
 246
 247         return MGMT_STATUS_FAILED;
 248 }
 249
 250 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 251                             u16 len, int flag)
 252 {
 253         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 254                                flag, NULL);
 255 }
 256
 257 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 258                               u16 len, int flag, struct sock *skip_sk)
 259 {
 260         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 261                                flag, skip_sk);
 262 }
 263
 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 265                       struct sock *skip_sk)
 266 {
 267         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 268                                HCI_SOCK_TRUSTED, skip_sk);
 269 }
 270
 271 static u8 le_addr_type(u8 mgmt_addr_type)
 272 {
 273         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 274                 return ADDR_LE_DEV_PUBLIC;
 275         else
 276                 return ADDR_LE_DEV_RANDOM;
 277 }
 278
 279 void mgmt_fill_version_info(void *ver)
 280 {
 281         struct mgmt_rp_read_version *rp = ver;
 282
 283         rp->version = MGMT_VERSION;
 284         rp->revision = cpu_to_le16(MGMT_REVISION);
 285 }
 286
 287 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 288                         u16 data_len)
 289 {
 290         struct mgmt_rp_read_version rp;
 291
 292         BT_DBG("sock %p", sk);
 293
 294         mgmt_fill_version_info(&rp);
 295
 296         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 297                                  &rp, sizeof(rp));
 298 }
 299
 300 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 301                          u16 data_len)
 302 {
 303         struct mgmt_rp_read_commands *rp;
 304         u16 num_commands, num_events;
 305         size_t rp_size;
 306         int i, err;
 307
 308         BT_DBG("sock %p", sk);
 309
 310         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 311                 num_commands = ARRAY_SIZE(mgmt_commands);
 312                 num_events = ARRAY_SIZE(mgmt_events);
 313         } else {
 314                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 315                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 316         }
 317
 318         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 319
 320         rp = kmalloc(rp_size, GFP_KERNEL);
 321         if (!rp)
 322                 return -ENOMEM;
 323
 324         rp->num_commands = cpu_to_le16(num_commands);
 325         rp->num_events = cpu_to_le16(num_events);
 326
 327         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 328                 __le16 *opcode = rp->opcodes;
 329
 330                 for (i = 0; i < num_commands; i++, opcode++)
 331                         put_unaligned_le16(mgmt_commands[i], opcode);
 332
 333                 for (i = 0; i < num_events; i++, opcode++)
 334                         put_unaligned_le16(mgmt_events[i], opcode);
 335         } else {
 336                 __le16 *opcode = rp->opcodes;
 337
 338                 for (i = 0; i < num_commands; i++, opcode++)
 339                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 340
 341                 for (i = 0; i < num_events; i++, opcode++)
 342                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 343         }
 344
 345         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 346                                 rp, rp_size);
 347         kfree(rp);
 348
 349         return err;
 350 }
 351
 352 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 353                            u16 data_len)
 354 {
 355         struct mgmt_rp_read_index_list *rp;
 356         struct hci_dev *d;
 357         size_t rp_len;
 358         u16 count;
 359         int err;
 360
 361         BT_DBG("sock %p", sk);
 362
 363         read_lock(&hci_dev_list_lock);
 364
 365         count = 0;
 366         list_for_each_entry(d, &hci_dev_list, list) {
 367                 if (d->dev_type == HCI_PRIMARY &&
 368                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 369                         count++;
 370         }
 371
 372         rp_len = sizeof(*rp) + (2 * count);
 373         rp = kmalloc(rp_len, GFP_ATOMIC);
 374         if (!rp) {
 375                 read_unlock(&hci_dev_list_lock);
 376                 return -ENOMEM;
 377         }
 378
 379         count = 0;
 380         list_for_each_entry(d, &hci_dev_list, list) {
 381                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 382                     hci_dev_test_flag(d, HCI_CONFIG) ||
 383                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 384                         continue;
 385
 386                 /* Devices marked as raw-only are neither configured
 387                  * nor unconfigured controllers.
 388                  */
 389                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 390                         continue;
 391
 392                 if (d->dev_type == HCI_PRIMARY &&
 393                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 394                         rp->index[count++] = cpu_to_le16(d->id);
 395                         BT_DBG("Added hci%u", d->id);
 396                 }
 397         }
 398
 399         rp->num_controllers = cpu_to_le16(count);
 400         rp_len = sizeof(*rp) + (2 * count);
 401
 402         read_unlock(&hci_dev_list_lock);
 403
 404         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 405                                 0, rp, rp_len);
 406
 407         kfree(rp);
 408
 409         return err;
 410 }
 411
 412 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 413                                   void *data, u16 data_len)
 414 {
 415         struct mgmt_rp_read_unconf_index_list *rp;
 416         struct hci_dev *d;
 417         size_t rp_len;
 418         u16 count;
 419         int err;
 420
 421         BT_DBG("sock %p", sk);
 422
 423         read_lock(&hci_dev_list_lock);
 424
 425         count = 0;
 426         list_for_each_entry(d, &hci_dev_list, list) {
 427                 if (d->dev_type == HCI_PRIMARY &&
 428                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 429                         count++;
 430         }
 431
 432         rp_len = sizeof(*rp) + (2 * count);
 433         rp = kmalloc(rp_len, GFP_ATOMIC);
 434         if (!rp) {
 435                 read_unlock(&hci_dev_list_lock);
 436                 return -ENOMEM;
 437         }
 438
 439         count = 0;
 440         list_for_each_entry(d, &hci_dev_list, list) {
 441                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 442                     hci_dev_test_flag(d, HCI_CONFIG) ||
 443                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 444                         continue;
 445
 446                 /* Devices marked as raw-only are neither configured
 447                  * nor unconfigured controllers.
 448                  */
 449                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 450                         continue;
 451
 452                 if (d->dev_type == HCI_PRIMARY &&
 453                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 454                         rp->index[count++] = cpu_to_le16(d->id);
 455                         BT_DBG("Added hci%u", d->id);
 456                 }
 457         }
 458
 459         rp->num_controllers = cpu_to_le16(count);
 460         rp_len = sizeof(*rp) + (2 * count);
 461
 462         read_unlock(&hci_dev_list_lock);
 463
 464         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 465                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 466
 467         kfree(rp);
 468
 469         return err;
 470 }
 471
 472 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 473                                void *data, u16 data_len)
 474 {
 475         struct mgmt_rp_read_ext_index_list *rp;
 476         struct hci_dev *d;
 477         size_t rp_len;
 478         u16 count;
 479         int err;
 480
 481         BT_DBG("sock %p", sk);
 482
 483         read_lock(&hci_dev_list_lock);
 484
 485         count = 0;
 486         list_for_each_entry(d, &hci_dev_list, list) {
 487                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 488                         count++;
 489         }
 490
 491         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 492         rp = kmalloc(rp_len, GFP_ATOMIC);
 493         if (!rp) {
 494                 read_unlock(&hci_dev_list_lock);
 495                 return -ENOMEM;
 496         }
 497
 498         count = 0;
 499         list_for_each_entry(d, &hci_dev_list, list) {
 500                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 501                     hci_dev_test_flag(d, HCI_CONFIG) ||
 502                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 503                         continue;
 504
 505                 /* Devices marked as raw-only are neither configured
 506                  * nor unconfigured controllers.
 507                  */
 508                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 509                         continue;
 510
 511                 if (d->dev_type == HCI_PRIMARY) {
 512                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 513                                 rp->entry[count].type = 0x01;
 514                         else
 515                                 rp->entry[count].type = 0x00;
 516                 } else if (d->dev_type == HCI_AMP) {
 517                         rp->entry[count].type = 0x02;
 518                 } else {
 519                         continue;
 520                 }
 521
 522                 rp->entry[count].bus = d->bus;
 523                 rp->entry[count++].index = cpu_to_le16(d->id);
 524                 BT_DBG("Added hci%u", d->id);
 525         }
 526
 527         rp->num_controllers = cpu_to_le16(count);
 528         rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
 529
 530         read_unlock(&hci_dev_list_lock);
 531
 532         /* If this command is called at least once, then all the
 533          * default index and unconfigured index events are disabled
 534          * and from now on only extended index events are used.
 535          */
 536         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 537         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 538         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 539
 540         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 541                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 542
 543         kfree(rp);
 544
 545         return err;
 546 }
 547
 548 static bool is_configured(struct hci_dev *hdev)
 549 {
 550         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 551             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 552                 return false;
 553
 554         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 555             !bacmp(&hdev->public_addr, BDADDR_ANY))
 556                 return false;
 557
 558         return true;
 559 }
 560
 561 static __le32 get_missing_options(struct hci_dev *hdev)
 562 {
 563         u32 options = 0;
 564
 565         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 566             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 567                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 568
 569         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 570             !bacmp(&hdev->public_addr, BDADDR_ANY))
 571                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 572
 573         return cpu_to_le32(options);
 574 }
 575
 576 static int new_options(struct hci_dev *hdev, struct sock *skip)
 577 {
 578         __le32 options = get_missing_options(hdev);
 579
 580         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 581                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 582 }
 583
 584 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 585 {
 586         __le32 options = get_missing_options(hdev);
 587
 588         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 589                                  sizeof(options));
 590 }
 591
 592 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 593                             void *data, u16 data_len)
 594 {
 595         struct mgmt_rp_read_config_info rp;
 596         u32 options = 0;
 597
 598         BT_DBG("sock %p %s", sk, hdev->name);
 599
 600         hci_dev_lock(hdev);
 601
 602         memset(&rp, 0, sizeof(rp));
 603         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 604
 605         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 606                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 607
 608         if (hdev->set_bdaddr)
 609                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 610
 611         rp.supported_options = cpu_to_le32(options);
 612         rp.missing_options = get_missing_options(hdev);
 613
 614         hci_dev_unlock(hdev);
 615
 616         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 617                                  &rp, sizeof(rp));
 618 }
 619
 620 static u32 get_supported_settings(struct hci_dev *hdev)
 621 {
 622         u32 settings = 0;
 623
 624         settings |= MGMT_SETTING_POWERED;
 625         settings |= MGMT_SETTING_BONDABLE;
 626         settings |= MGMT_SETTING_DEBUG_KEYS;
 627         settings |= MGMT_SETTING_CONNECTABLE;
 628         settings |= MGMT_SETTING_DISCOVERABLE;
 629
 630         if (lmp_bredr_capable(hdev)) {
 631                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 632                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 633                 settings |= MGMT_SETTING_BREDR;
 634                 settings |= MGMT_SETTING_LINK_SECURITY;
 635
 636                 if (lmp_ssp_capable(hdev)) {
 637                         settings |= MGMT_SETTING_SSP;
 638                         settings |= MGMT_SETTING_HS;
 639                 }
 640
 641                 if (lmp_sc_capable(hdev))
 642                         settings |= MGMT_SETTING_SECURE_CONN;
 643         }
 644
 645         if (lmp_le_capable(hdev)) {
 646                 settings |= MGMT_SETTING_LE;
 647                 settings |= MGMT_SETTING_ADVERTISING;
 648                 settings |= MGMT_SETTING_SECURE_CONN;
 649                 settings |= MGMT_SETTING_PRIVACY;
 650                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 651         }
 652
 653         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 654             hdev->set_bdaddr)
 655                 settings |= MGMT_SETTING_CONFIGURATION;
 656
 657         return settings;
 658 }
 659
 660 static u32 get_current_settings(struct hci_dev *hdev)
 661 {
 662         u32 settings = 0;
 663
 664         if (hdev_is_powered(hdev))
 665                 settings |= MGMT_SETTING_POWERED;
 666
 667         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 668                 settings |= MGMT_SETTING_CONNECTABLE;
 669
 670         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 671                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 672
 673         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 674                 settings |= MGMT_SETTING_DISCOVERABLE;
 675
 676         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 677                 settings |= MGMT_SETTING_BONDABLE;
 678
 679         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 680                 settings |= MGMT_SETTING_BREDR;
 681
 682         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 683                 settings |= MGMT_SETTING_LE;
 684
 685         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 686                 settings |= MGMT_SETTING_LINK_SECURITY;
 687
 688         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 689                 settings |= MGMT_SETTING_SSP;
 690
 691         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 692                 settings |= MGMT_SETTING_HS;
 693
 694         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 695                 settings |= MGMT_SETTING_ADVERTISING;
 696
 697         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 698                 settings |= MGMT_SETTING_SECURE_CONN;
 699
 700         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 701                 settings |= MGMT_SETTING_DEBUG_KEYS;
 702
 703         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 704                 settings |= MGMT_SETTING_PRIVACY;
 705
 706         /* The current setting for static address has two purposes. The
 707          * first is to indicate if the static address will be used and
 708          * the second is to indicate if it is actually set.
 709          *
 710          * This means if the static address is not configured, this flag
 711          * will never be set. If the address is configured, then if the
 712          * address is actually used decides if the flag is set or not.
 713          *
 714          * For single mode LE only controllers and dual-mode controllers
 715          * with BR/EDR disabled, the existence of the static address will
 716          * be evaluated.
 717          */
 718         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 719             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 720             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 721                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 722                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 723         }
 724
 725         return settings;
 726 }
 727
 728 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 729 {
 730         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 731 }
 732
 733 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 734                                                   struct hci_dev *hdev,
 735                                                   const void *data)
 736 {
 737         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 738 }
 739
 740 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 741 {
 742         struct mgmt_pending_cmd *cmd;
 743
 744         /* If there's a pending mgmt command the flags will not yet have
 745          * their final values, so check for this first.
 746          */
 747         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 748         if (cmd) {
 749                 struct mgmt_mode *cp = cmd->param;
 750                 if (cp->val == 0x01)
 751                         return LE_AD_GENERAL;
 752                 else if (cp->val == 0x02)
 753                         return LE_AD_LIMITED;
 754         } else {
 755                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 756                         return LE_AD_LIMITED;
 757                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 758                         return LE_AD_GENERAL;
 759         }
 760
 761         return 0;
 762 }
 763
 764 bool mgmt_get_connectable(struct hci_dev *hdev)
 765 {
 766         struct mgmt_pending_cmd *cmd;
 767
 768         /* If there's a pending mgmt command the flag will not yet have
 769          * it's final value, so check for this first.
 770          */
 771         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 772         if (cmd) {
 773                 struct mgmt_mode *cp = cmd->param;
 774
 775                 return cp->val;
 776         }
 777
 778         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 779 }
 780
 781 static void service_cache_off(struct work_struct *work)
 782 {
 783         struct hci_dev *hdev = container_of(work, struct hci_dev,
 784                                             service_cache.work);
 785         struct hci_request req;
 786
 787         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 788                 return;
 789
 790         hci_req_init(&req, hdev);
 791
 792         hci_dev_lock(hdev);
 793
 794         __hci_req_update_eir(&req);
 795         __hci_req_update_class(&req);
 796
 797         hci_dev_unlock(hdev);
 798
 799         hci_req_run(&req, NULL);
 800 }
 801
 802 static void rpa_expired(struct work_struct *work)
 803 {
 804         struct hci_dev *hdev = container_of(work, struct hci_dev,
 805                                             rpa_expired.work);
 806         struct hci_request req;
 807
 808         BT_DBG("");
 809
 810         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 811
 812         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 813                 return;
 814
 815         /* The generation of a new RPA and programming it into the
 816          * controller happens in the hci_req_enable_advertising()
 817          * function.
 818          */
 819         hci_req_init(&req, hdev);
 820         __hci_req_enable_advertising(&req);
 821         hci_req_run(&req, NULL);
 822 }
 823
 824 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 825 {
 826         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
 827                 return;
 828
 829         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 830         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 831
 832         /* Non-mgmt controlled devices get this bit set
 833          * implicitly so that pairing works for them, however
 834          * for mgmt we require user-space to explicitly enable
 835          * it
 836          */
 837         hci_dev_clear_flag(hdev, HCI_BONDABLE);
 838 }
 839
 840 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 841                                 void *data, u16 data_len)
 842 {
 843         struct mgmt_rp_read_info rp;
 844
 845         BT_DBG("sock %p %s", sk, hdev->name);
 846
 847         hci_dev_lock(hdev);
 848
 849         memset(&rp, 0, sizeof(rp));
 850
 851         bacpy(&rp.bdaddr, &hdev->bdaddr);
 852
 853         rp.version = hdev->hci_ver;
 854         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 855
 856         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 857         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 858
 859         memcpy(rp.dev_class, hdev->dev_class, 3);
 860
 861         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 862         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 863
 864         hci_dev_unlock(hdev);
 865
 866         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 867                                  sizeof(rp));
 868 }
 869
 870 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
 871                                   u8 data_len)
 872 {
 873         eir[eir_len++] = sizeof(type) + data_len;
 874         eir[eir_len++] = type;
 875         memcpy(&eir[eir_len], data, data_len);
 876         eir_len += data_len;
 877
 878         return eir_len;
 879 }
 880
 881 static inline u16 eir_append_le16(u8 *eir, u16 eir_len, u8 type, u16 data)
 882 {
 883         eir[eir_len++] = sizeof(type) + sizeof(data);
 884         eir[eir_len++] = type;
 885         put_unaligned_le16(data, &eir[eir_len]);
 886         eir_len += sizeof(data);
 887
 888         return eir_len;
 889 }
 890
 891 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
 892 {
 893         u16 eir_len = 0;
 894         size_t name_len;
 895
 896         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 897                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
 898                                           hdev->dev_class, 3);
 899
 900         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 901                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
 902                                           hdev->appearance);
 903
 904         name_len = strlen(hdev->dev_name);
 905         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
 906                                   hdev->dev_name, name_len);
 907
 908         name_len = strlen(hdev->short_name);
 909         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
 910                                   hdev->short_name, name_len);
 911
 912         return eir_len;
 913 }
 914
 915 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
 916                                     void *data, u16 data_len)
 917 {
 918         char buf[512];
 919         struct mgmt_rp_read_ext_info *rp = (void *)buf;
 920         u16 eir_len;
 921
 922         BT_DBG("sock %p %s", sk, hdev->name);
 923
 924         memset(&buf, 0, sizeof(buf));
 925
 926         hci_dev_lock(hdev);
 927
 928         bacpy(&rp->bdaddr, &hdev->bdaddr);
 929
 930         rp->version = hdev->hci_ver;
 931         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
 932
 933         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
 934         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
 935
 936
 937         eir_len = append_eir_data_to_buf(hdev, rp->eir);
 938         rp->eir_len = cpu_to_le16(eir_len);
 939
 940         hci_dev_unlock(hdev);
 941
 942         /* If this command is called at least once, then the events
 943          * for class of device and local name changes are disabled
 944          * and only the new extended controller information event
 945          * is used.
 946          */
 947         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
 948         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
 949         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
 950
 951         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
 952                                  sizeof(*rp) + eir_len);
 953 }
 954
 955 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
 956 {
 957         struct mgmt_ev_ext_info_changed ev;
 958
 959         ev.eir_len = cpu_to_le16(0);
 960
 961         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, &ev,
 962                                   sizeof(ev), HCI_MGMT_EXT_INFO_EVENTS, skip);
 963 }
 964
 965 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 966 {
 967         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 968
 969         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
 970                                  sizeof(settings));
 971 }
 972
 973 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 974 {
 975         BT_DBG("%s status 0x%02x", hdev->name, status);
 976
 977         if (hci_conn_count(hdev) == 0) {
 978                 cancel_delayed_work(&hdev->power_off);
 979                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 980         }
 981 }
 982
 983 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
 984 {
 985         struct mgmt_ev_advertising_added ev;
 986
 987         ev.instance = instance;
 988
 989         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
 990 }
 991
 992 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
 993                               u8 instance)
 994 {
 995         struct mgmt_ev_advertising_removed ev;
 996
 997         ev.instance = instance;
 998
 999         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1000 }
1001
1002 static void cancel_adv_timeout(struct hci_dev *hdev)
1003 {
1004         if (hdev->adv_instance_timeout) {
1005                 hdev->adv_instance_timeout = 0;
1006                 cancel_delayed_work(&hdev->adv_instance_expire);
1007         }
1008 }
1009
1010 static int clean_up_hci_state(struct hci_dev *hdev)
1011 {
1012         struct hci_request req;
1013         struct hci_conn *conn;
1014         bool discov_stopped;
1015         int err;
1016
1017         hci_req_init(&req, hdev);
1018
1019         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1020             test_bit(HCI_PSCAN, &hdev->flags)) {
1021                 u8 scan = 0x00;
1022                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1023         }
1024
1025         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1026
1027         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1028                 __hci_req_disable_advertising(&req);
1029
1030         discov_stopped = hci_req_stop_discovery(&req);
1031
1032         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1033                 /* 0x15 == Terminated due to Power Off */
1034                 __hci_abort_conn(&req, conn, 0x15);
1035         }
1036
1037         err = hci_req_run(&req, clean_up_hci_complete);
1038         if (!err && discov_stopped)
1039                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1040
1041         return err;
1042 }
1043
1044 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1045                        u16 len)
1046 {
1047         struct mgmt_mode *cp = data;
1048         struct mgmt_pending_cmd *cmd;
1049         int err;
1050
1051         BT_DBG("request for %s", hdev->name);
1052
1053         if (cp->val != 0x00 && cp->val != 0x01)
1054                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1055                                        MGMT_STATUS_INVALID_PARAMS);
1056
1057         hci_dev_lock(hdev);
1058
1059         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1060                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1061                                       MGMT_STATUS_BUSY);
1062                 goto failed;
1063         }
1064
1065         if (!!cp->val == hdev_is_powered(hdev)) {
1066                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1067                 goto failed;
1068         }
1069
1070         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1071         if (!cmd) {
1072                 err = -ENOMEM;
1073                 goto failed;
1074         }
1075
1076         if (cp->val) {
1077                 queue_work(hdev->req_workqueue, &hdev->power_on);
1078                 err = 0;
1079         } else {
1080                 /* Disconnect connections, stop scans, etc */
1081                 err = clean_up_hci_state(hdev);
1082                 if (!err)
1083                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1084                                            HCI_POWER_OFF_TIMEOUT);
1085
1086                 /* ENODATA means there were no HCI commands queued */
1087                 if (err == -ENODATA) {
1088                         cancel_delayed_work(&hdev->power_off);
1089                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1090                         err = 0;
1091                 }
1092         }
1093
1094 failed:
1095         hci_dev_unlock(hdev);
1096         return err;
1097 }
1098
1099 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1100 {
1101         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1102
1103         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1104                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1105 }
1106
1107 int mgmt_new_settings(struct hci_dev *hdev)
1108 {
1109         return new_settings(hdev, NULL);
1110 }
1111
1112 struct cmd_lookup {
1113         struct sock *sk;
1114         struct hci_dev *hdev;
1115         u8 mgmt_status;
1116 };
1117
1118 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1119 {
1120         struct cmd_lookup *match = data;
1121
1122         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1123
1124         list_del(&cmd->list);
1125
1126         if (match->sk == NULL) {
1127                 match->sk = cmd->sk;
1128                 sock_hold(match->sk);
1129         }
1130
1131         mgmt_pending_free(cmd);
1132 }
1133
1134 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1135 {
1136         u8 *status = data;
1137
1138         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1139         mgmt_pending_remove(cmd);
1140 }
1141
1142 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1143 {
1144         if (cmd->cmd_complete) {
1145                 u8 *status = data;
1146
1147                 cmd->cmd_complete(cmd, *status);
1148                 mgmt_pending_remove(cmd);
1149
1150                 return;
1151         }
1152
1153         cmd_status_rsp(cmd, data);
1154 }
1155
1156 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1157 {
1158         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1159                                  cmd->param, cmd->param_len);
1160 }
1161
1162 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1163 {
1164         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1165                                  cmd->param, sizeof(struct mgmt_addr_info));
1166 }
1167
1168 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1169 {
1170         if (!lmp_bredr_capable(hdev))
1171                 return MGMT_STATUS_NOT_SUPPORTED;
1172         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1173                 return MGMT_STATUS_REJECTED;
1174         else
1175                 return MGMT_STATUS_SUCCESS;
1176 }
1177
1178 static u8 mgmt_le_support(struct hci_dev *hdev)
1179 {
1180         if (!lmp_le_capable(hdev))
1181                 return MGMT_STATUS_NOT_SUPPORTED;
1182         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1183                 return MGMT_STATUS_REJECTED;
1184         else
1185                 return MGMT_STATUS_SUCCESS;
1186 }
1187
1188 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1189 {
1190         struct mgmt_pending_cmd *cmd;
1191
1192         BT_DBG("status 0x%02x", status);
1193
1194         hci_dev_lock(hdev);
1195
1196         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1197         if (!cmd)
1198                 goto unlock;
1199
1200         if (status) {
1201                 u8 mgmt_err = mgmt_status(status);
1202                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1203                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1204                 goto remove_cmd;
1205         }
1206
1207         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1208             hdev->discov_timeout > 0) {
1209                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1210                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1211         }
1212
1213         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1214         new_settings(hdev, cmd->sk);
1215
1216 remove_cmd:
1217         mgmt_pending_remove(cmd);
1218
1219 unlock:
1220         hci_dev_unlock(hdev);
1221 }
1222
1223 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1224                             u16 len)
1225 {
1226         struct mgmt_cp_set_discoverable *cp = data;
1227         struct mgmt_pending_cmd *cmd;
1228         u16 timeout;
1229         int err;
1230
1231         BT_DBG("request for %s", hdev->name);
1232
1233         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1234             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1235                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1236                                        MGMT_STATUS_REJECTED);
1237
1238         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1239                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1240                                        MGMT_STATUS_INVALID_PARAMS);
1241
1242         timeout = __le16_to_cpu(cp->timeout);
1243
1244         /* Disabling discoverable requires that no timeout is set,
1245          * and enabling limited discoverable requires a timeout.
1246          */
1247         if ((cp->val == 0x00 && timeout > 0) ||
1248             (cp->val == 0x02 && timeout == 0))
1249                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1250                                        MGMT_STATUS_INVALID_PARAMS);
1251
1252         hci_dev_lock(hdev);
1253
1254         if (!hdev_is_powered(hdev) && timeout > 0) {
1255                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1256                                       MGMT_STATUS_NOT_POWERED);
1257                 goto failed;
1258         }
1259
1260         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1261             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1262                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1263                                       MGMT_STATUS_BUSY);
1264                 goto failed;
1265         }
1266
1267         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1268                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1269                                       MGMT_STATUS_REJECTED);
1270                 goto failed;
1271         }
1272
1273         if (!hdev_is_powered(hdev)) {
1274                 bool changed = false;
1275
1276                 /* Setting limited discoverable when powered off is
1277                  * not a valid operation since it requires a timeout
1278                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1279                  */
1280                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1281                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1282                         changed = true;
1283                 }
1284
1285                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1286                 if (err < 0)
1287                         goto failed;
1288
1289                 if (changed)
1290                         err = new_settings(hdev, sk);
1291
1292                 goto failed;
1293         }
1294
1295         /* If the current mode is the same, then just update the timeout
1296          * value with the new value. And if only the timeout gets updated,
1297          * then no need for any HCI transactions.
1298          */
1299         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1300             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1301                                                    HCI_LIMITED_DISCOVERABLE)) {
1302                 cancel_delayed_work(&hdev->discov_off);
1303                 hdev->discov_timeout = timeout;
1304
1305                 if (cp->val && hdev->discov_timeout > 0) {
1306                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1307                         queue_delayed_work(hdev->req_workqueue,
1308                                            &hdev->discov_off, to);
1309                 }
1310
1311                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1312                 goto failed;
1313         }
1314
1315         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1316         if (!cmd) {
1317                 err = -ENOMEM;
1318                 goto failed;
1319         }
1320
1321         /* Cancel any potential discoverable timeout that might be
1322          * still active and store new timeout value. The arming of
1323          * the timeout happens in the complete handler.
1324          */
1325         cancel_delayed_work(&hdev->discov_off);
1326         hdev->discov_timeout = timeout;
1327
1328         if (cp->val)
1329                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1330         else
1331                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1332
1333         /* Limited discoverable mode */
1334         if (cp->val == 0x02)
1335                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1336         else
1337                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1338
1339         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1340         err = 0;
1341
1342 failed:
1343         hci_dev_unlock(hdev);
1344         return err;
1345 }
1346
1347 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1348 {
1349         struct mgmt_pending_cmd *cmd;
1350
1351         BT_DBG("status 0x%02x", status);
1352
1353         hci_dev_lock(hdev);
1354
1355         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1356         if (!cmd)
1357                 goto unlock;
1358
1359         if (status) {
1360                 u8 mgmt_err = mgmt_status(status);
1361                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1362                 goto remove_cmd;
1363         }
1364
1365         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1366         new_settings(hdev, cmd->sk);
1367
1368 remove_cmd:
1369         mgmt_pending_remove(cmd);
1370
1371 unlock:
1372         hci_dev_unlock(hdev);
1373 }
1374
1375 static int set_connectable_update_settings(struct hci_dev *hdev,
1376                                            struct sock *sk, u8 val)
1377 {
1378         bool changed = false;
1379         int err;
1380
1381         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1382                 changed = true;
1383
1384         if (val) {
1385                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1386         } else {
1387                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1388                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1389         }
1390
1391         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1392         if (err < 0)
1393                 return err;
1394
1395         if (changed) {
1396                 hci_req_update_scan(hdev);
1397                 hci_update_background_scan(hdev);
1398                 return new_settings(hdev, sk);
1399         }
1400
1401         return 0;
1402 }
1403
1404 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1405                            u16 len)
1406 {
1407         struct mgmt_mode *cp = data;
1408         struct mgmt_pending_cmd *cmd;
1409         int err;
1410
1411         BT_DBG("request for %s", hdev->name);
1412
1413         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1414             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1415                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1416                                        MGMT_STATUS_REJECTED);
1417
1418         if (cp->val != 0x00 && cp->val != 0x01)
1419                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1420                                        MGMT_STATUS_INVALID_PARAMS);
1421
1422         hci_dev_lock(hdev);
1423
1424         if (!hdev_is_powered(hdev)) {
1425                 err = set_connectable_update_settings(hdev, sk, cp->val);
1426                 goto failed;
1427         }
1428
1429         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1430             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1431                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1432                                       MGMT_STATUS_BUSY);
1433                 goto failed;
1434         }
1435
1436         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1437         if (!cmd) {
1438                 err = -ENOMEM;
1439                 goto failed;
1440         }
1441
1442         if (cp->val) {
1443                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1444         } else {
1445                 if (hdev->discov_timeout > 0)
1446                         cancel_delayed_work(&hdev->discov_off);
1447
1448                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1449                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1450                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1451         }
1452
1453         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1454         err = 0;
1455
1456 failed:
1457         hci_dev_unlock(hdev);
1458         return err;
1459 }
1460
1461 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1462                         u16 len)
1463 {
1464         struct mgmt_mode *cp = data;
1465         bool changed;
1466         int err;
1467
1468         BT_DBG("request for %s", hdev->name);
1469
1470         if (cp->val != 0x00 && cp->val != 0x01)
1471                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1472                                        MGMT_STATUS_INVALID_PARAMS);
1473
1474         hci_dev_lock(hdev);
1475
1476         if (cp->val)
1477                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1478         else
1479                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1480
1481         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1482         if (err < 0)
1483                 goto unlock;
1484
1485         if (changed) {
1486                 /* In limited privacy mode the change of bondable mode
1487                  * may affect the local advertising address.
1488                  */
1489                 if (hdev_is_powered(hdev) &&
1490                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1491                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1492                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1493                         queue_work(hdev->req_workqueue,
1494                                    &hdev->discoverable_update);
1495
1496                 err = new_settings(hdev, sk);
1497         }
1498
1499 unlock:
1500         hci_dev_unlock(hdev);
1501         return err;
1502 }
1503
1504 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1505                              u16 len)
1506 {
1507         struct mgmt_mode *cp = data;
1508         struct mgmt_pending_cmd *cmd;
1509         u8 val, status;
1510         int err;
1511
1512         BT_DBG("request for %s", hdev->name);
1513
1514         status = mgmt_bredr_support(hdev);
1515         if (status)
1516                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1517                                        status);
1518
1519         if (cp->val != 0x00 && cp->val != 0x01)
1520                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1521                                        MGMT_STATUS_INVALID_PARAMS);
1522
1523         hci_dev_lock(hdev);
1524
1525         if (!hdev_is_powered(hdev)) {
1526                 bool changed = false;
1527
1528                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1529                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1530                         changed = true;
1531                 }
1532
1533                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1534                 if (err < 0)
1535                         goto failed;
1536
1537                 if (changed)
1538                         err = new_settings(hdev, sk);
1539
1540                 goto failed;
1541         }
1542
1543         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1544                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1545                                       MGMT_STATUS_BUSY);
1546                 goto failed;
1547         }
1548
1549         val = !!cp->val;
1550
1551         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1552                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1553                 goto failed;
1554         }
1555
1556         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1557         if (!cmd) {
1558                 err = -ENOMEM;
1559                 goto failed;
1560         }
1561
1562         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1563         if (err < 0) {
1564                 mgmt_pending_remove(cmd);
1565                 goto failed;
1566         }
1567
1568 failed:
1569         hci_dev_unlock(hdev);
1570         return err;
1571 }
1572
1573 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1574 {
1575         struct mgmt_mode *cp = data;
1576         struct mgmt_pending_cmd *cmd;
1577         u8 status;
1578         int err;
1579
1580         BT_DBG("request for %s", hdev->name);
1581
1582         status = mgmt_bredr_support(hdev);
1583         if (status)
1584                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1585
1586         if (!lmp_ssp_capable(hdev))
1587                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1588                                        MGMT_STATUS_NOT_SUPPORTED);
1589
1590         if (cp->val != 0x00 && cp->val != 0x01)
1591                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1592                                        MGMT_STATUS_INVALID_PARAMS);
1593
1594         hci_dev_lock(hdev);
1595
1596         if (!hdev_is_powered(hdev)) {
1597                 bool changed;
1598
1599                 if (cp->val) {
1600                         changed = !hci_dev_test_and_set_flag(hdev,
1601                                                              HCI_SSP_ENABLED);
1602                 } else {
1603                         changed = hci_dev_test_and_clear_flag(hdev,
1604                                                               HCI_SSP_ENABLED);
1605                         if (!changed)
1606                                 changed = hci_dev_test_and_clear_flag(hdev,
1607                                                                       HCI_HS_ENABLED);
1608                         else
1609                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1610                 }
1611
1612                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1613                 if (err < 0)
1614                         goto failed;
1615
1616                 if (changed)
1617                         err = new_settings(hdev, sk);
1618
1619                 goto failed;
1620         }
1621
1622         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1623                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1624                                       MGMT_STATUS_BUSY);
1625                 goto failed;
1626         }
1627
1628         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1629                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1630                 goto failed;
1631         }
1632
1633         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1634         if (!cmd) {
1635                 err = -ENOMEM;
1636                 goto failed;
1637         }
1638
1639         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1640                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1641                              sizeof(cp->val), &cp->val);
1642
1643         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1644         if (err < 0) {
1645                 mgmt_pending_remove(cmd);
1646                 goto failed;
1647         }
1648
1649 failed:
1650         hci_dev_unlock(hdev);
1651         return err;
1652 }
1653
1654 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1655 {
1656         struct mgmt_mode *cp = data;
1657         bool changed;
1658         u8 status;
1659         int err;
1660
1661         BT_DBG("request for %s", hdev->name);
1662
1663         status = mgmt_bredr_support(hdev);
1664         if (status)
1665                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1666
1667         if (!lmp_ssp_capable(hdev))
1668                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1669                                        MGMT_STATUS_NOT_SUPPORTED);
1670
1671         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1672                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1673                                        MGMT_STATUS_REJECTED);
1674
1675         if (cp->val != 0x00 && cp->val != 0x01)
1676                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1677                                        MGMT_STATUS_INVALID_PARAMS);
1678
1679         hci_dev_lock(hdev);
1680
1681         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1682                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1683                                       MGMT_STATUS_BUSY);
1684                 goto unlock;
1685         }
1686
1687         if (cp->val) {
1688                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1689         } else {
1690                 if (hdev_is_powered(hdev)) {
1691                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1692                                               MGMT_STATUS_REJECTED);
1693                         goto unlock;
1694                 }
1695
1696                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1697         }
1698
1699         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1700         if (err < 0)
1701                 goto unlock;
1702
1703         if (changed)
1704                 err = new_settings(hdev, sk);
1705
1706 unlock:
1707         hci_dev_unlock(hdev);
1708         return err;
1709 }
1710
1711 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1712 {
1713         struct cmd_lookup match = { NULL, hdev };
1714
1715         hci_dev_lock(hdev);
1716
1717         if (status) {
1718                 u8 mgmt_err = mgmt_status(status);
1719
1720                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1721                                      &mgmt_err);
1722                 goto unlock;
1723         }
1724
1725         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1726
1727         new_settings(hdev, match.sk);
1728
1729         if (match.sk)
1730                 sock_put(match.sk);
1731
1732         /* Make sure the controller has a good default for
1733          * advertising data. Restrict the update to when LE
1734          * has actually been enabled. During power on, the
1735          * update in powered_update_hci will take care of it.
1736          */
1737         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1738                 struct hci_request req;
1739
1740                 hci_req_init(&req, hdev);
1741                 __hci_req_update_adv_data(&req, 0x00);
1742                 __hci_req_update_scan_rsp_data(&req, 0x00);
1743                 hci_req_run(&req, NULL);
1744                 hci_update_background_scan(hdev);
1745         }
1746
1747 unlock:
1748         hci_dev_unlock(hdev);
1749 }
1750
1751 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1752 {
1753         struct mgmt_mode *cp = data;
1754         struct hci_cp_write_le_host_supported hci_cp;
1755         struct mgmt_pending_cmd *cmd;
1756         struct hci_request req;
1757         int err;
1758         u8 val, enabled;
1759
1760         BT_DBG("request for %s", hdev->name);
1761
1762         if (!lmp_le_capable(hdev))
1763                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1764                                        MGMT_STATUS_NOT_SUPPORTED);
1765
1766         if (cp->val != 0x00 && cp->val != 0x01)
1767                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1768                                        MGMT_STATUS_INVALID_PARAMS);
1769
1770         /* Bluetooth single mode LE only controllers or dual-mode
1771          * controllers configured as LE only devices, do not allow
1772          * switching LE off. These have either LE enabled explicitly
1773          * or BR/EDR has been previously switched off.
1774          *
1775          * When trying to enable an already enabled LE, then gracefully
1776          * send a positive response. Trying to disable it however will
1777          * result into rejection.
1778          */
1779         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1780                 if (cp->val == 0x01)
1781                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1782
1783                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1784                                        MGMT_STATUS_REJECTED);
1785         }
1786
1787         hci_dev_lock(hdev);
1788
1789         val = !!cp->val;
1790         enabled = lmp_host_le_capable(hdev);
1791
1792         if (!val)
1793                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1794
1795         if (!hdev_is_powered(hdev) || val == enabled) {
1796                 bool changed = false;
1797
1798                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1799                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1800                         changed = true;
1801                 }
1802
1803                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1804                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1805                         changed = true;
1806                 }
1807
1808                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1809                 if (err < 0)
1810                         goto unlock;
1811
1812                 if (changed)
1813                         err = new_settings(hdev, sk);
1814
1815                 goto unlock;
1816         }
1817
1818         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1819             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1820                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1821                                       MGMT_STATUS_BUSY);
1822                 goto unlock;
1823         }
1824
1825         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1826         if (!cmd) {
1827                 err = -ENOMEM;
1828                 goto unlock;
1829         }
1830
1831         hci_req_init(&req, hdev);
1832
1833         memset(&hci_cp, 0, sizeof(hci_cp));
1834
1835         if (val) {
1836                 hci_cp.le = val;
1837                 hci_cp.simul = 0x00;
1838         } else {
1839                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1840                         __hci_req_disable_advertising(&req);
1841         }
1842
1843         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1844                     &hci_cp);
1845
1846         err = hci_req_run(&req, le_enable_complete);
1847         if (err < 0)
1848                 mgmt_pending_remove(cmd);
1849
1850 unlock:
1851         hci_dev_unlock(hdev);
1852         return err;
1853 }
1854
1855 /* This is a helper function to test for pending mgmt commands that can
1856  * cause CoD or EIR HCI commands. We can only allow one such pending
1857  * mgmt command at a time since otherwise we cannot easily track what
1858  * the current values are, will be, and based on that calculate if a new
1859  * HCI command needs to be sent and if yes with what value.
1860  */
1861 static bool pending_eir_or_class(struct hci_dev *hdev)
1862 {
1863         struct mgmt_pending_cmd *cmd;
1864
1865         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1866                 switch (cmd->opcode) {
1867                 case MGMT_OP_ADD_UUID:
1868                 case MGMT_OP_REMOVE_UUID:
1869                 case MGMT_OP_SET_DEV_CLASS:
1870                 case MGMT_OP_SET_POWERED:
1871                         return true;
1872                 }
1873         }
1874
1875         return false;
1876 }
1877
1878 static const u8 bluetooth_base_uuid[] = {
1879                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1880                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1881 };
1882
1883 static u8 get_uuid_size(const u8 *uuid)
1884 {
1885         u32 val;
1886
1887         if (memcmp(uuid, bluetooth_base_uuid, 12))
1888                 return 128;
1889
1890         val = get_unaligned_le32(&uuid[12]);
1891         if (val > 0xffff)
1892                 return 32;
1893
1894         return 16;
1895 }
1896
1897 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1898 {
1899         struct mgmt_pending_cmd *cmd;
1900
1901         hci_dev_lock(hdev);
1902
1903         cmd = pending_find(mgmt_op, hdev);
1904         if (!cmd)
1905                 goto unlock;
1906
1907         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
1908                           mgmt_status(status), hdev->dev_class, 3);
1909
1910         mgmt_pending_remove(cmd);
1911
1912 unlock:
1913         hci_dev_unlock(hdev);
1914 }
1915
1916 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1917 {
1918         BT_DBG("status 0x%02x", status);
1919
1920         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1921 }
1922
1923 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1924 {
1925         struct mgmt_cp_add_uuid *cp = data;
1926         struct mgmt_pending_cmd *cmd;
1927         struct hci_request req;
1928         struct bt_uuid *uuid;
1929         int err;
1930
1931         BT_DBG("request for %s", hdev->name);
1932
1933         hci_dev_lock(hdev);
1934
1935         if (pending_eir_or_class(hdev)) {
1936                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1937                                       MGMT_STATUS_BUSY);
1938                 goto failed;
1939         }
1940
1941         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1942         if (!uuid) {
1943                 err = -ENOMEM;
1944                 goto failed;
1945         }
1946
1947         memcpy(uuid->uuid, cp->uuid, 16);
1948         uuid->svc_hint = cp->svc_hint;
1949         uuid->size = get_uuid_size(cp->uuid);
1950
1951         list_add_tail(&uuid->list, &hdev->uuids);
1952
1953         hci_req_init(&req, hdev);
1954
1955         __hci_req_update_class(&req);
1956         __hci_req_update_eir(&req);
1957
1958         err = hci_req_run(&req, add_uuid_complete);
1959         if (err < 0) {
1960                 if (err != -ENODATA)
1961                         goto failed;
1962
1963                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1964                                         hdev->dev_class, 3);
1965                 goto failed;
1966         }
1967
1968         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1969         if (!cmd) {
1970                 err = -ENOMEM;
1971                 goto failed;
1972         }
1973
1974         err = 0;
1975
1976 failed:
1977         hci_dev_unlock(hdev);
1978         return err;
1979 }
1980
1981 static bool enable_service_cache(struct hci_dev *hdev)
1982 {
1983         if (!hdev_is_powered(hdev))
1984                 return false;
1985
1986         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
1987                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1988                                    CACHE_TIMEOUT);
1989                 return true;
1990         }
1991
1992         return false;
1993 }
1994
1995 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1996 {
1997         BT_DBG("status 0x%02x", status);
1998
1999         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2000 }
2001
2002 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2003                        u16 len)
2004 {
2005         struct mgmt_cp_remove_uuid *cp = data;
2006         struct mgmt_pending_cmd *cmd;
2007         struct bt_uuid *match, *tmp;
2008         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2009         struct hci_request req;
2010         int err, found;
2011
2012         BT_DBG("request for %s", hdev->name);
2013
2014         hci_dev_lock(hdev);
2015
2016         if (pending_eir_or_class(hdev)) {
2017                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2018                                       MGMT_STATUS_BUSY);
2019                 goto unlock;
2020         }
2021
2022         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2023                 hci_uuids_clear(hdev);
2024
2025                 if (enable_service_cache(hdev)) {
2026                         err = mgmt_cmd_complete(sk, hdev->id,
2027                                                 MGMT_OP_REMOVE_UUID,
2028                                                 0, hdev->dev_class, 3);
2029                         goto unlock;
2030                 }
2031
2032                 goto update_class;
2033         }
2034
2035         found = 0;
2036
2037         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2038                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2039                         continue;
2040
2041                 list_del(&match->list);
2042                 kfree(match);
2043                 found++;
2044         }
2045
2046         if (found == 0) {
2047                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2048                                       MGMT_STATUS_INVALID_PARAMS);
2049                 goto unlock;
2050         }
2051
2052 update_class:
2053         hci_req_init(&req, hdev);
2054
2055         __hci_req_update_class(&req);
2056         __hci_req_update_eir(&req);
2057
2058         err = hci_req_run(&req, remove_uuid_complete);
2059         if (err < 0) {
2060                 if (err != -ENODATA)
2061                         goto unlock;
2062
2063                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2064                                         hdev->dev_class, 3);
2065                 goto unlock;
2066         }
2067
2068         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2069         if (!cmd) {
2070                 err = -ENOMEM;
2071                 goto unlock;
2072         }
2073
2074         err = 0;
2075
2076 unlock:
2077         hci_dev_unlock(hdev);
2078         return err;
2079 }
2080
2081 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2082 {
2083         BT_DBG("status 0x%02x", status);
2084
2085         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2086 }
2087
2088 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2089                          u16 len)
2090 {
2091         struct mgmt_cp_set_dev_class *cp = data;
2092         struct mgmt_pending_cmd *cmd;
2093         struct hci_request req;
2094         int err;
2095
2096         BT_DBG("request for %s", hdev->name);
2097
2098         if (!lmp_bredr_capable(hdev))
2099                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2100                                        MGMT_STATUS_NOT_SUPPORTED);
2101
2102         hci_dev_lock(hdev);
2103
2104         if (pending_eir_or_class(hdev)) {
2105                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2106                                       MGMT_STATUS_BUSY);
2107                 goto unlock;
2108         }
2109
2110         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2111                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2112                                       MGMT_STATUS_INVALID_PARAMS);
2113                 goto unlock;
2114         }
2115
2116         hdev->major_class = cp->major;
2117         hdev->minor_class = cp->minor;
2118
2119         if (!hdev_is_powered(hdev)) {
2120                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2121                                         hdev->dev_class, 3);
2122                 goto unlock;
2123         }
2124
2125         hci_req_init(&req, hdev);
2126
2127         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2128                 hci_dev_unlock(hdev);
2129                 cancel_delayed_work_sync(&hdev->service_cache);
2130                 hci_dev_lock(hdev);
2131                 __hci_req_update_eir(&req);
2132         }
2133
2134         __hci_req_update_class(&req);
2135
2136         err = hci_req_run(&req, set_class_complete);
2137         if (err < 0) {
2138                 if (err != -ENODATA)
2139                         goto unlock;
2140
2141                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2142                                         hdev->dev_class, 3);
2143                 goto unlock;
2144         }
2145
2146         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2147         if (!cmd) {
2148                 err = -ENOMEM;
2149                 goto unlock;
2150         }
2151
2152         err = 0;
2153
2154 unlock:
2155         hci_dev_unlock(hdev);
2156         return err;
2157 }
2158
2159 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2160                           u16 len)
2161 {
2162         struct mgmt_cp_load_link_keys *cp = data;
2163         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2164                                    sizeof(struct mgmt_link_key_info));
2165         u16 key_count, expected_len;
2166         bool changed;
2167         int i;
2168
2169         BT_DBG("request for %s", hdev->name);
2170
2171         if (!lmp_bredr_capable(hdev))
2172                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2173                                        MGMT_STATUS_NOT_SUPPORTED);
2174
2175         key_count = __le16_to_cpu(cp->key_count);
2176         if (key_count > max_key_count) {
2177                 BT_ERR("load_link_keys: too big key_count value %u",
2178                        key_count);
2179                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2180                                        MGMT_STATUS_INVALID_PARAMS);
2181         }
2182
2183         expected_len = sizeof(*cp) + key_count *
2184                                         sizeof(struct mgmt_link_key_info);
2185         if (expected_len != len) {
2186                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2187                        expected_len, len);
2188                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2189                                        MGMT_STATUS_INVALID_PARAMS);
2190         }
2191
2192         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2193                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2194                                        MGMT_STATUS_INVALID_PARAMS);
2195
2196         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2197                key_count);
2198
2199         for (i = 0; i < key_count; i++) {
2200                 struct mgmt_link_key_info *key = &cp->keys[i];
2201
2202                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2203                         return mgmt_cmd_status(sk, hdev->id,
2204                                                MGMT_OP_LOAD_LINK_KEYS,
2205                                                MGMT_STATUS_INVALID_PARAMS);
2206         }
2207
2208         hci_dev_lock(hdev);
2209
2210         hci_link_keys_clear(hdev);
2211
2212         if (cp->debug_keys)
2213                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2214         else
2215                 changed = hci_dev_test_and_clear_flag(hdev,
2216                                                       HCI_KEEP_DEBUG_KEYS);
2217
2218         if (changed)
2219                 new_settings(hdev, NULL);
2220
2221         for (i = 0; i < key_count; i++) {
2222                 struct mgmt_link_key_info *key = &cp->keys[i];
2223
2224                 /* Always ignore debug keys and require a new pairing if
2225                  * the user wants to use them.
2226                  */
2227                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2228                         continue;
2229
2230                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2231                                  key->type, key->pin_len, NULL);
2232         }
2233
2234         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2235
2236         hci_dev_unlock(hdev);
2237
2238         return 0;
2239 }
2240
2241 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2242                            u8 addr_type, struct sock *skip_sk)
2243 {
2244         struct mgmt_ev_device_unpaired ev;
2245
2246         bacpy(&ev.addr.bdaddr, bdaddr);
2247         ev.addr.type = addr_type;
2248
2249         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2250                           skip_sk);
2251 }
2252
2253 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2254                          u16 len)
2255 {
2256         struct mgmt_cp_unpair_device *cp = data;
2257         struct mgmt_rp_unpair_device rp;
2258         struct hci_conn_params *params;
2259         struct mgmt_pending_cmd *cmd;
2260         struct hci_conn *conn;
2261         u8 addr_type;
2262         int err;
2263
2264         memset(&rp, 0, sizeof(rp));
2265         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2266         rp.addr.type = cp->addr.type;
2267
2268         if (!bdaddr_type_is_valid(cp->addr.type))
2269                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2270                                          MGMT_STATUS_INVALID_PARAMS,
2271                                          &rp, sizeof(rp));
2272
2273         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2274                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2275                                          MGMT_STATUS_INVALID_PARAMS,
2276                                          &rp, sizeof(rp));
2277
2278         hci_dev_lock(hdev);
2279
2280         if (!hdev_is_powered(hdev)) {
2281                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2282                                         MGMT_STATUS_NOT_POWERED, &rp,
2283                                         sizeof(rp));
2284                 goto unlock;
2285         }
2286
2287         if (cp->addr.type == BDADDR_BREDR) {
2288                 /* If disconnection is requested, then look up the
2289                  * connection. If the remote device is connected, it
2290                  * will be later used to terminate the link.
2291                  *
2292                  * Setting it to NULL explicitly will cause no
2293                  * termination of the link.
2294                  */
2295                 if (cp->disconnect)
2296                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2297                                                        &cp->addr.bdaddr);
2298                 else
2299                         conn = NULL;
2300
2301                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2302                 if (err < 0) {
2303                         err = mgmt_cmd_complete(sk, hdev->id,
2304                                                 MGMT_OP_UNPAIR_DEVICE,
2305                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2306                                                 sizeof(rp));
2307                         goto unlock;
2308                 }
2309
2310                 goto done;
2311         }
2312
2313         /* LE address type */
2314         addr_type = le_addr_type(cp->addr.type);
2315
2316         hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2317
2318         err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2319         if (err < 0) {
2320                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2321                                         MGMT_STATUS_NOT_PAIRED, &rp,
2322                                         sizeof(rp));
2323                 goto unlock;
2324         }
2325
2326         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2327         if (!conn) {
2328                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2329                 goto done;
2330         }
2331
2332         /* Abort any ongoing SMP pairing */
2333         smp_cancel_pairing(conn);
2334
2335         /* Defer clearing up the connection parameters until closing to
2336          * give a chance of keeping them if a repairing happens.
2337          */
2338         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2339
2340         /* Disable auto-connection parameters if present */
2341         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2342         if (params) {
2343                 if (params->explicit_connect)
2344                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2345                 else
2346                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2347         }
2348
2349         /* If disconnection is not requested, then clear the connection
2350          * variable so that the link is not terminated.
2351          */
2352         if (!cp->disconnect)
2353                 conn = NULL;
2354
2355 done:
2356         /* If the connection variable is set, then termination of the
2357          * link is requested.
2358          */
2359         if (!conn) {
2360                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2361                                         &rp, sizeof(rp));
2362                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2363                 goto unlock;
2364         }
2365
2366         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2367                                sizeof(*cp));
2368         if (!cmd) {
2369                 err = -ENOMEM;
2370                 goto unlock;
2371         }
2372
2373         cmd->cmd_complete = addr_cmd_complete;
2374
2375         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2376         if (err < 0)
2377                 mgmt_pending_remove(cmd);
2378
2379 unlock:
2380         hci_dev_unlock(hdev);
2381         return err;
2382 }
2383
2384 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2385                       u16 len)
2386 {
2387         struct mgmt_cp_disconnect *cp = data;
2388         struct mgmt_rp_disconnect rp;
2389         struct mgmt_pending_cmd *cmd;
2390         struct hci_conn *conn;
2391         int err;
2392
2393         BT_DBG("");
2394
2395         memset(&rp, 0, sizeof(rp));
2396         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2397         rp.addr.type = cp->addr.type;
2398
2399         if (!bdaddr_type_is_valid(cp->addr.type))
2400                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2401                                          MGMT_STATUS_INVALID_PARAMS,
2402                                          &rp, sizeof(rp));
2403
2404         hci_dev_lock(hdev);
2405
2406         if (!test_bit(HCI_UP, &hdev->flags)) {
2407                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2408                                         MGMT_STATUS_NOT_POWERED, &rp,
2409                                         sizeof(rp));
2410                 goto failed;
2411         }
2412
2413         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2414                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2415                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2416                 goto failed;
2417         }
2418
2419         if (cp->addr.type == BDADDR_BREDR)
2420                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2421                                                &cp->addr.bdaddr);
2422         else
2423                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2424                                                le_addr_type(cp->addr.type));
2425
2426         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2427                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2428                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2429                                         sizeof(rp));
2430                 goto failed;
2431         }
2432
2433         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2434         if (!cmd) {
2435                 err = -ENOMEM;
2436                 goto failed;
2437         }
2438
2439         cmd->cmd_complete = generic_cmd_complete;
2440
2441         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2442         if (err < 0)
2443                 mgmt_pending_remove(cmd);
2444
2445 failed:
2446         hci_dev_unlock(hdev);
2447         return err;
2448 }
2449
2450 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2451 {
2452         switch (link_type) {
2453         case LE_LINK:
2454                 switch (addr_type) {
2455                 case ADDR_LE_DEV_PUBLIC:
2456                         return BDADDR_LE_PUBLIC;
2457
2458                 default:
2459                         /* Fallback to LE Random address type */
2460                         return BDADDR_LE_RANDOM;
2461                 }
2462
2463         default:
2464                 /* Fallback to BR/EDR type */
2465                 return BDADDR_BREDR;
2466         }
2467 }
2468
2469 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2470                            u16 data_len)
2471 {
2472         struct mgmt_rp_get_connections *rp;
2473         struct hci_conn *c;
2474         size_t rp_len;
2475         int err;
2476         u16 i;
2477
2478         BT_DBG("");
2479
2480         hci_dev_lock(hdev);
2481
2482         if (!hdev_is_powered(hdev)) {
2483                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2484                                       MGMT_STATUS_NOT_POWERED);
2485                 goto unlock;
2486         }
2487
2488         i = 0;
2489         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2490                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2491                         i++;
2492         }
2493
2494         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2495         rp = kmalloc(rp_len, GFP_KERNEL);
2496         if (!rp) {
2497                 err = -ENOMEM;
2498                 goto unlock;
2499         }
2500
2501         i = 0;
2502         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2503                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2504                         continue;
2505                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2506                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2507                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2508                         continue;
2509                 i++;
2510         }
2511
2512         rp->conn_count = cpu_to_le16(i);
2513
2514         /* Recalculate length in case of filtered SCO connections, etc */
2515         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2516
2517         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2518                                 rp_len);
2519
2520         kfree(rp);
2521
2522 unlock:
2523         hci_dev_unlock(hdev);
2524         return err;
2525 }
2526
2527 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2528                                    struct mgmt_cp_pin_code_neg_reply *cp)
2529 {
2530         struct mgmt_pending_cmd *cmd;
2531         int err;
2532
2533         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2534                                sizeof(*cp));
2535         if (!cmd)
2536                 return -ENOMEM;
2537
2538         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2539                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2540         if (err < 0)
2541                 mgmt_pending_remove(cmd);
2542
2543         return err;
2544 }
2545
2546 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2547                           u16 len)
2548 {
2549         struct hci_conn *conn;
2550         struct mgmt_cp_pin_code_reply *cp = data;
2551         struct hci_cp_pin_code_reply reply;
2552         struct mgmt_pending_cmd *cmd;
2553         int err;
2554
2555         BT_DBG("");
2556
2557         hci_dev_lock(hdev);
2558
2559         if (!hdev_is_powered(hdev)) {
2560                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2561                                       MGMT_STATUS_NOT_POWERED);
2562                 goto failed;
2563         }
2564
2565         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2566         if (!conn) {
2567                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2568                                       MGMT_STATUS_NOT_CONNECTED);
2569                 goto failed;
2570         }
2571
2572         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2573                 struct mgmt_cp_pin_code_neg_reply ncp;
2574
2575                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2576
2577                 BT_ERR("PIN code is not 16 bytes long");
2578
2579                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2580                 if (err >= 0)
2581                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2582                                               MGMT_STATUS_INVALID_PARAMS);
2583
2584                 goto failed;
2585         }
2586
2587         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2588         if (!cmd) {
2589                 err = -ENOMEM;
2590                 goto failed;
2591         }
2592
2593         cmd->cmd_complete = addr_cmd_complete;
2594
2595         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2596         reply.pin_len = cp->pin_len;
2597         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2598
2599         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2600         if (err < 0)
2601                 mgmt_pending_remove(cmd);
2602
2603 failed:
2604         hci_dev_unlock(hdev);
2605         return err;
2606 }
2607
2608 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2609                              u16 len)
2610 {
2611         struct mgmt_cp_set_io_capability *cp = data;
2612
2613         BT_DBG("");
2614
2615         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2616                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2617                                        MGMT_STATUS_INVALID_PARAMS);
2618
2619         hci_dev_lock(hdev);
2620
2621         hdev->io_capability = cp->io_capability;
2622
2623         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2624                hdev->io_capability);
2625
2626         hci_dev_unlock(hdev);
2627
2628         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2629                                  NULL, 0);
2630 }
2631
2632 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2633 {
2634         struct hci_dev *hdev = conn->hdev;
2635         struct mgmt_pending_cmd *cmd;
2636
2637         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2638                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2639                         continue;
2640
2641                 if (cmd->user_data != conn)
2642                         continue;
2643
2644                 return cmd;
2645         }
2646
2647         return NULL;
2648 }
2649
2650 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2651 {
2652         struct mgmt_rp_pair_device rp;
2653         struct hci_conn *conn = cmd->user_data;
2654         int err;
2655
2656         bacpy(&rp.addr.bdaddr, &conn->dst);
2657         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2658
2659         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2660                                 status, &rp, sizeof(rp));
2661
2662         /* So we don't get further callbacks for this connection */
2663         conn->connect_cfm_cb = NULL;
2664         conn->security_cfm_cb = NULL;
2665         conn->disconn_cfm_cb = NULL;
2666
2667         hci_conn_drop(conn);
2668
2669         /* The device is paired so there is no need to remove
2670          * its connection parameters anymore.
2671          */
2672         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2673
2674         hci_conn_put(conn);
2675
2676         return err;
2677 }
2678
2679 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2680 {
2681         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2682         struct mgmt_pending_cmd *cmd;
2683
2684         cmd = find_pairing(conn);
2685         if (cmd) {
2686                 cmd->cmd_complete(cmd, status);
2687                 mgmt_pending_remove(cmd);
2688         }
2689 }
2690
2691 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2692 {
2693         struct mgmt_pending_cmd *cmd;
2694
2695         BT_DBG("status %u", status);
2696
2697         cmd = find_pairing(conn);
2698         if (!cmd) {
2699                 BT_DBG("Unable to find a pending command");
2700                 return;
2701         }
2702
2703         cmd->cmd_complete(cmd, mgmt_status(status));
2704         mgmt_pending_remove(cmd);
2705 }
2706
2707 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2708 {
2709         struct mgmt_pending_cmd *cmd;
2710
2711         BT_DBG("status %u", status);
2712
2713         if (!status)
2714                 return;
2715
2716         cmd = find_pairing(conn);
2717         if (!cmd) {
2718                 BT_DBG("Unable to find a pending command");
2719                 return;
2720         }
2721
2722         cmd->cmd_complete(cmd, mgmt_status(status));
2723         mgmt_pending_remove(cmd);
2724 }
2725
2726 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2727                        u16 len)
2728 {
2729         struct mgmt_cp_pair_device *cp = data;
2730         struct mgmt_rp_pair_device rp;
2731         struct mgmt_pending_cmd *cmd;
2732         u8 sec_level, auth_type;
2733         struct hci_conn *conn;
2734         int err;
2735
2736         BT_DBG("");
2737
2738         memset(&rp, 0, sizeof(rp));
2739         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2740         rp.addr.type = cp->addr.type;
2741
2742         if (!bdaddr_type_is_valid(cp->addr.type))
2743                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2744                                          MGMT_STATUS_INVALID_PARAMS,
2745                                          &rp, sizeof(rp));
2746
2747         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2748                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2749                                          MGMT_STATUS_INVALID_PARAMS,
2750                                          &rp, sizeof(rp));
2751
2752         hci_dev_lock(hdev);
2753
2754         if (!hdev_is_powered(hdev)) {
2755                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2756                                         MGMT_STATUS_NOT_POWERED, &rp,
2757                                         sizeof(rp));
2758                 goto unlock;
2759         }
2760
2761         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2762                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2763                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2764                                         sizeof(rp));
2765                 goto unlock;
2766         }
2767
2768         sec_level = BT_SECURITY_MEDIUM;
2769         auth_type = HCI_AT_DEDICATED_BONDING;
2770
2771         if (cp->addr.type == BDADDR_BREDR) {
2772                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2773                                        auth_type);
2774         } else {
2775                 u8 addr_type = le_addr_type(cp->addr.type);
2776                 struct hci_conn_params *p;
2777
2778                 /* When pairing a new device, it is expected to remember
2779                  * this device for future connections. Adding the connection
2780                  * parameter information ahead of time allows tracking
2781                  * of the slave preferred values and will speed up any
2782                  * further connection establishment.
2783                  *
2784                  * If connection parameters already exist, then they
2785                  * will be kept and this function does nothing.
2786                  */
2787                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2788
2789                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2790                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2791
2792                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2793                                            addr_type, sec_level,
2794                                            HCI_LE_CONN_TIMEOUT);
2795         }
2796
2797         if (IS_ERR(conn)) {
2798                 int status;
2799
2800                 if (PTR_ERR(conn) == -EBUSY)
2801                         status = MGMT_STATUS_BUSY;
2802                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2803                         status = MGMT_STATUS_NOT_SUPPORTED;
2804                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2805                         status = MGMT_STATUS_REJECTED;
2806                 else
2807                         status = MGMT_STATUS_CONNECT_FAILED;
2808
2809                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2810                                         status, &rp, sizeof(rp));
2811                 goto unlock;
2812         }
2813
2814         if (conn->connect_cfm_cb) {
2815                 hci_conn_drop(conn);
2816                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2817                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2818                 goto unlock;
2819         }
2820
2821         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2822         if (!cmd) {
2823                 err = -ENOMEM;
2824                 hci_conn_drop(conn);
2825                 goto unlock;
2826         }
2827
2828         cmd->cmd_complete = pairing_complete;
2829
2830         /* For LE, just connecting isn't a proof that the pairing finished */
2831         if (cp->addr.type == BDADDR_BREDR) {
2832                 conn->connect_cfm_cb = pairing_complete_cb;
2833                 conn->security_cfm_cb = pairing_complete_cb;
2834                 conn->disconn_cfm_cb = pairing_complete_cb;
2835         } else {
2836                 conn->connect_cfm_cb = le_pairing_complete_cb;
2837                 conn->security_cfm_cb = le_pairing_complete_cb;
2838                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2839         }
2840
2841         conn->io_capability = cp->io_cap;
2842         cmd->user_data = hci_conn_get(conn);
2843
2844         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2845             hci_conn_security(conn, sec_level, auth_type, true)) {
2846                 cmd->cmd_complete(cmd, 0);
2847                 mgmt_pending_remove(cmd);
2848         }
2849
2850         err = 0;
2851
2852 unlock:
2853         hci_dev_unlock(hdev);
2854         return err;
2855 }
2856
2857 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2858                               u16 len)
2859 {
2860         struct mgmt_addr_info *addr = data;
2861         struct mgmt_pending_cmd *cmd;
2862         struct hci_conn *conn;
2863         int err;
2864
2865         BT_DBG("");
2866
2867         hci_dev_lock(hdev);
2868
2869         if (!hdev_is_powered(hdev)) {
2870                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2871                                       MGMT_STATUS_NOT_POWERED);
2872                 goto unlock;
2873         }
2874
2875         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2876         if (!cmd) {
2877                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2878                                       MGMT_STATUS_INVALID_PARAMS);
2879                 goto unlock;
2880         }
2881
2882         conn = cmd->user_data;
2883
2884         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2885                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2886                                       MGMT_STATUS_INVALID_PARAMS);
2887                 goto unlock;
2888         }
2889
2890         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
2891         mgmt_pending_remove(cmd);
2892
2893         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2894                                 addr, sizeof(*addr));
2895 unlock:
2896         hci_dev_unlock(hdev);
2897         return err;
2898 }
2899
2900 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2901                              struct mgmt_addr_info *addr, u16 mgmt_op,
2902                              u16 hci_op, __le32 passkey)
2903 {
2904         struct mgmt_pending_cmd *cmd;
2905         struct hci_conn *conn;
2906         int err;
2907
2908         hci_dev_lock(hdev);
2909
2910         if (!hdev_is_powered(hdev)) {
2911                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2912                                         MGMT_STATUS_NOT_POWERED, addr,
2913                                         sizeof(*addr));
2914                 goto done;
2915         }
2916
2917         if (addr->type == BDADDR_BREDR)
2918                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2919         else
2920                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
2921                                                le_addr_type(addr->type));
2922
2923         if (!conn) {
2924                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2925                                         MGMT_STATUS_NOT_CONNECTED, addr,
2926                                         sizeof(*addr));
2927                 goto done;
2928         }
2929
2930         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2931                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2932                 if (!err)
2933                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2934                                                 MGMT_STATUS_SUCCESS, addr,
2935                                                 sizeof(*addr));
2936                 else
2937                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2938                                                 MGMT_STATUS_FAILED, addr,
2939                                                 sizeof(*addr));
2940
2941                 goto done;
2942         }
2943
2944         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2945         if (!cmd) {
2946                 err = -ENOMEM;
2947                 goto done;
2948         }
2949
2950         cmd->cmd_complete = addr_cmd_complete;
2951
2952         /* Continue with pairing via HCI */
2953         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2954                 struct hci_cp_user_passkey_reply cp;
2955
2956                 bacpy(&cp.bdaddr, &addr->bdaddr);
2957                 cp.passkey = passkey;
2958                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2959         } else
2960                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2961                                    &addr->bdaddr);
2962
2963         if (err < 0)
2964                 mgmt_pending_remove(cmd);
2965
2966 done:
2967         hci_dev_unlock(hdev);
2968         return err;
2969 }
2970
2971 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2972                               void *data, u16 len)
2973 {
2974         struct mgmt_cp_pin_code_neg_reply *cp = data;
2975
2976         BT_DBG("");
2977
2978         return user_pairing_resp(sk, hdev, &cp->addr,
2979                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2980                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2981 }
2982
2983 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2984                               u16 len)
2985 {
2986         struct mgmt_cp_user_confirm_reply *cp = data;
2987
2988         BT_DBG("");
2989
2990         if (len != sizeof(*cp))
2991                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2992                                        MGMT_STATUS_INVALID_PARAMS);
2993
2994         return user_pairing_resp(sk, hdev, &cp->addr,
2995                                  MGMT_OP_USER_CONFIRM_REPLY,
2996                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2997 }
2998
2999 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3000                                   void *data, u16 len)
3001 {
3002         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3003
3004         BT_DBG("");
3005
3006         return user_pairing_resp(sk, hdev, &cp->addr,
3007                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3008                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3009 }
3010
3011 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3012                               u16 len)
3013 {
3014         struct mgmt_cp_user_passkey_reply *cp = data;
3015
3016         BT_DBG("");
3017
3018         return user_pairing_resp(sk, hdev, &cp->addr,
3019                                  MGMT_OP_USER_PASSKEY_REPLY,
3020                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3021 }
3022
3023 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3024                                   void *data, u16 len)
3025 {
3026         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3027
3028         BT_DBG("");
3029
3030         return user_pairing_resp(sk, hdev, &cp->addr,
3031                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3032                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3033 }
3034
3035 static void adv_expire(struct hci_dev *hdev, u32 flags)
3036 {
3037         struct adv_info *adv_instance;
3038         struct hci_request req;
3039         int err;
3040
3041         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3042         if (!adv_instance)
3043                 return;
3044
3045         /* stop if current instance doesn't need to be changed */
3046         if (!(adv_instance->flags & flags))
3047                 return;
3048
3049         cancel_adv_timeout(hdev);
3050
3051         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3052         if (!adv_instance)
3053                 return;
3054
3055         hci_req_init(&req, hdev);
3056         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3057                                               true);
3058         if (err)
3059                 return;
3060
3061         hci_req_run(&req, NULL);
3062 }
3063
3064 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3065 {
3066         struct mgmt_cp_set_local_name *cp;
3067         struct mgmt_pending_cmd *cmd;
3068
3069         BT_DBG("status 0x%02x", status);
3070
3071         hci_dev_lock(hdev);
3072
3073         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3074         if (!cmd)
3075                 goto unlock;
3076
3077         cp = cmd->param;
3078
3079         if (status) {
3080                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3081                                 mgmt_status(status));
3082         } else {
3083                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3084                                   cp, sizeof(*cp));
3085
3086                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3087                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3088         }
3089
3090         mgmt_pending_remove(cmd);
3091
3092 unlock:
3093         hci_dev_unlock(hdev);
3094 }
3095
3096 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3097                           u16 len)
3098 {
3099         struct mgmt_cp_set_local_name *cp = data;
3100         struct mgmt_pending_cmd *cmd;
3101         struct hci_request req;
3102         int err;
3103
3104         BT_DBG("");
3105
3106         hci_dev_lock(hdev);
3107
3108         /* If the old values are the same as the new ones just return a
3109          * direct command complete event.
3110          */
3111         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3112             !memcmp(hdev->short_name, cp->short_name,
3113                     sizeof(hdev->short_name))) {
3114                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3115                                         data, len);
3116                 goto failed;
3117         }
3118
3119         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3120
3121         if (!hdev_is_powered(hdev)) {
3122                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3123
3124                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3125                                         data, len);
3126                 if (err < 0)
3127                         goto failed;
3128
3129                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3130                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3131                 ext_info_changed(hdev, sk);
3132
3133                 goto failed;
3134         }
3135
3136         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3137         if (!cmd) {
3138                 err = -ENOMEM;
3139                 goto failed;
3140         }
3141
3142         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3143
3144         hci_req_init(&req, hdev);
3145
3146         if (lmp_bredr_capable(hdev)) {
3147                 __hci_req_update_name(&req);
3148                 __hci_req_update_eir(&req);
3149         }
3150
3151         /* The name is stored in the scan response data and so
3152          * no need to udpate the advertising data here.
3153          */
3154         if (lmp_le_capable(hdev))
3155                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3156
3157         err = hci_req_run(&req, set_name_complete);
3158         if (err < 0)
3159                 mgmt_pending_remove(cmd);
3160
3161 failed:
3162         hci_dev_unlock(hdev);
3163         return err;
3164 }
3165
3166 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3167                           u16 len)
3168 {
3169         struct mgmt_cp_set_appearance *cp = data;
3170         u16 apperance;
3171         int err;
3172
3173         BT_DBG("");
3174
3175         apperance = le16_to_cpu(cp->appearance);
3176
3177         hci_dev_lock(hdev);
3178
3179         if (hdev->appearance != apperance) {
3180                 hdev->appearance = apperance;
3181
3182                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3183                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3184         }
3185
3186         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3187                                 0);
3188
3189         hci_dev_unlock(hdev);
3190
3191         return err;
3192 }
3193
3194 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3195                                          u16 opcode, struct sk_buff *skb)
3196 {
3197         struct mgmt_rp_read_local_oob_data mgmt_rp;
3198         size_t rp_size = sizeof(mgmt_rp);
3199         struct mgmt_pending_cmd *cmd;
3200
3201         BT_DBG("%s status %u", hdev->name, status);
3202
3203         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3204         if (!cmd)
3205                 return;
3206
3207         if (status || !skb) {
3208                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3209                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3210                 goto remove;
3211         }
3212
3213         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3214
3215         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3216                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3217
3218                 if (skb->len < sizeof(*rp)) {
3219                         mgmt_cmd_status(cmd->sk, hdev->id,
3220                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3221                                         MGMT_STATUS_FAILED);
3222                         goto remove;
3223                 }
3224
3225                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3226                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3227
3228                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3229         } else {
3230                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3231
3232                 if (skb->len < sizeof(*rp)) {
3233                         mgmt_cmd_status(cmd->sk, hdev->id,
3234                                         MGMT_OP_READ_LOCAL_OOB_DATA,
3235                                         MGMT_STATUS_FAILED);
3236                         goto remove;
3237                 }
3238
3239                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3240                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3241
3242                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3243                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3244         }
3245
3246         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3247                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3248
3249 remove:
3250         mgmt_pending_remove(cmd);
3251 }
3252
3253 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3254                                void *data, u16 data_len)
3255 {
3256         struct mgmt_pending_cmd *cmd;
3257         struct hci_request req;
3258         int err;
3259
3260         BT_DBG("%s", hdev->name);
3261
3262         hci_dev_lock(hdev);
3263
3264         if (!hdev_is_powered(hdev)) {
3265                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3266                                       MGMT_STATUS_NOT_POWERED);
3267                 goto unlock;
3268         }
3269
3270         if (!lmp_ssp_capable(hdev)) {
3271                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3272                                       MGMT_STATUS_NOT_SUPPORTED);
3273                 goto unlock;
3274         }
3275
3276         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3277                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3278                                       MGMT_STATUS_BUSY);
3279                 goto unlock;
3280         }
3281
3282         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3283         if (!cmd) {
3284                 err = -ENOMEM;
3285                 goto unlock;
3286         }
3287
3288         hci_req_init(&req, hdev);
3289
3290         if (bredr_sc_enabled(hdev))
3291                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3292         else
3293                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3294
3295         err = hci_req_run_skb(&req, read_local_oob_data_complete);
3296         if (err < 0)
3297                 mgmt_pending_remove(cmd);
3298
3299 unlock:
3300         hci_dev_unlock(hdev);
3301         return err;
3302 }
3303
3304 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3305                                void *data, u16 len)
3306 {
3307         struct mgmt_addr_info *addr = data;
3308         int err;
3309
3310         BT_DBG("%s ", hdev->name);
3311
3312         if (!bdaddr_type_is_valid(addr->type))
3313                 return mgmt_cmd_complete(sk, hdev->id,
3314                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
3315                                          MGMT_STATUS_INVALID_PARAMS,
3316                                          addr, sizeof(*addr));
3317
3318         hci_dev_lock(hdev);
3319
3320         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3321                 struct mgmt_cp_add_remote_oob_data *cp = data;
3322                 u8 status;
3323
3324                 if (cp->addr.type != BDADDR_BREDR) {
3325                         err = mgmt_cmd_complete(sk, hdev->id,
3326                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
3327                                                 MGMT_STATUS_INVALID_PARAMS,
3328                                                 &cp->addr, sizeof(cp->addr));
3329                         goto unlock;
3330                 }
3331
3332                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3333                                               cp->addr.type, cp->hash,
3334                                               cp->rand, NULL, NULL);
3335                 if (err < 0)
3336                         status = MGMT_STATUS_FAILED;
3337                 else
3338                         status = MGMT_STATUS_SUCCESS;
3339
3340                 err = mgmt_cmd_complete(sk, hdev->id,
3341                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3342                                         &cp->addr, sizeof(cp->addr));
3343         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3344                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3345                 u8 *rand192, *hash192, *rand256, *hash256;
3346                 u8 status;
3347
3348                 if (bdaddr_type_is_le(cp->addr.type)) {
3349                         /* Enforce zero-valued 192-bit parameters as
3350                          * long as legacy SMP OOB isn't implemented.
3351                          */
3352                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3353                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3354                                 err = mgmt_cmd_complete(sk, hdev->id,
3355                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3356                                                         MGMT_STATUS_INVALID_PARAMS,
3357                                                         addr, sizeof(*addr));
3358                                 goto unlock;
3359                         }
3360
3361                         rand192 = NULL;
3362                         hash192 = NULL;
3363                 } else {
3364                         /* In case one of the P-192 values is set to zero,
3365                          * then just disable OOB data for P-192.
3366                          */
3367                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3368                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
3369                                 rand192 = NULL;
3370                                 hash192 = NULL;
3371                         } else {
3372                                 rand192 = cp->rand192;
3373                                 hash192 = cp->hash192;
3374                         }
3375                 }
3376
3377                 /* In case one of the P-256 values is set to zero, then just
3378                  * disable OOB data for P-256.
3379                  */
3380                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3381                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
3382                         rand256 = NULL;
3383                         hash256 = NULL;
3384                 } else {
3385                         rand256 = cp->rand256;
3386                         hash256 = cp->hash256;
3387                 }
3388
3389                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3390                                               cp->addr.type, hash192, rand192,
3391                                               hash256, rand256);
3392                 if (err < 0)
3393                         status = MGMT_STATUS_FAILED;
3394                 else
3395                         status = MGMT_STATUS_SUCCESS;
3396
3397                 err = mgmt_cmd_complete(sk, hdev->id,
3398                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
3399                                         status, &cp->addr, sizeof(cp->addr));
3400         } else {
3401                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3402                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3403                                       MGMT_STATUS_INVALID_PARAMS);
3404         }
3405
3406 unlock:
3407         hci_dev_unlock(hdev);
3408         return err;
3409 }
3410
3411 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3412                                   void *data, u16 len)
3413 {
3414         struct mgmt_cp_remove_remote_oob_data *cp = data;
3415         u8 status;
3416         int err;
3417
3418         BT_DBG("%s", hdev->name);
3419
3420         if (cp->addr.type != BDADDR_BREDR)
3421                 return mgmt_cmd_complete(sk, hdev->id,
3422                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3423                                          MGMT_STATUS_INVALID_PARAMS,
3424                                          &cp->addr, sizeof(cp->addr));
3425
3426         hci_dev_lock(hdev);
3427
3428         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3429                 hci_remote_oob_data_clear(hdev);
3430                 status = MGMT_STATUS_SUCCESS;
3431                 goto done;
3432         }
3433
3434         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3435         if (err < 0)
3436                 status = MGMT_STATUS_INVALID_PARAMS;
3437         else
3438                 status = MGMT_STATUS_SUCCESS;
3439
3440 done:
3441         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3442                                 status, &cp->addr, sizeof(cp->addr));
3443
3444         hci_dev_unlock(hdev);
3445         return err;
3446 }
3447
3448 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3449 {
3450         struct mgmt_pending_cmd *cmd;
3451
3452         BT_DBG("status %d", status);
3453
3454         hci_dev_lock(hdev);
3455
3456         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3457         if (!cmd)
3458                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3459
3460         if (!cmd)
3461                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3462
3463         if (cmd) {
3464                 cmd->cmd_complete(cmd, mgmt_status(status));
3465                 mgmt_pending_remove(cmd);
3466         }
3467
3468         hci_dev_unlock(hdev);
3469 }
3470
3471 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3472                                     uint8_t *mgmt_status)
3473 {
3474         switch (type) {
3475         case DISCOV_TYPE_LE:
3476                 *mgmt_status = mgmt_le_support(hdev);
3477                 if (*mgmt_status)
3478                         return false;
3479                 break;
3480         case DISCOV_TYPE_INTERLEAVED:
3481                 *mgmt_status = mgmt_le_support(hdev);
3482                 if (*mgmt_status)
3483                         return false;
3484                 /* Intentional fall-through */
3485         case DISCOV_TYPE_BREDR:
3486                 *mgmt_status = mgmt_bredr_support(hdev);
3487                 if (*mgmt_status)
3488                         return false;
3489                 break;
3490         default:
3491                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3492                 return false;
3493         }
3494
3495         return true;
3496 }
3497
3498 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3499                                     u16 op, void *data, u16 len)
3500 {
3501         struct mgmt_cp_start_discovery *cp = data;
3502         struct mgmt_pending_cmd *cmd;
3503         u8 status;
3504         int err;
3505
3506         BT_DBG("%s", hdev->name);
3507
3508         hci_dev_lock(hdev);
3509
3510         if (!hdev_is_powered(hdev)) {
3511                 err = mgmt_cmd_complete(sk, hdev->id, op,
3512                                         MGMT_STATUS_NOT_POWERED,
3513                                         &cp->type, sizeof(cp->type));
3514                 goto failed;
3515         }
3516
3517         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3518             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3519                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3520                                         &cp->type, sizeof(cp->type));
3521                 goto failed;
3522         }
3523
3524         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3525                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3526                                         &cp->type, sizeof(cp->type));
3527                 goto failed;
3528         }
3529
3530         /* Clear the discovery filter first to free any previously
3531          * allocated memory for the UUID list.
3532          */
3533         hci_discovery_filter_clear(hdev);
3534
3535         hdev->discovery.type = cp->type;
3536         hdev->discovery.report_invalid_rssi = false;
3537         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3538                 hdev->discovery.limited = true;
3539         else
3540                 hdev->discovery.limited = false;
3541
3542         cmd = mgmt_pending_add(sk, op, hdev, data, len);
3543         if (!cmd) {
3544                 err = -ENOMEM;
3545                 goto failed;
3546         }
3547
3548         cmd->cmd_complete = generic_cmd_complete;
3549
3550         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3551         queue_work(hdev->req_workqueue, &hdev->discov_update);
3552         err = 0;
3553
3554 failed:
3555         hci_dev_unlock(hdev);
3556         return err;
3557 }
3558
3559 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3560                            void *data, u16 len)
3561 {
3562         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3563                                         data, len);
3564 }
3565
3566 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3567                                    void *data, u16 len)
3568 {
3569         return start_discovery_internal(sk, hdev,
3570                                         MGMT_OP_START_LIMITED_DISCOVERY,
3571                                         data, len);
3572 }
3573
3574 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3575                                           u8 status)
3576 {
3577         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3578                                  cmd->param, 1);
3579 }
3580
3581 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3582                                    void *data, u16 len)
3583 {
3584         struct mgmt_cp_start_service_discovery *cp = data;
3585         struct mgmt_pending_cmd *cmd;
3586         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3587         u16 uuid_count, expected_len;
3588         u8 status;
3589         int err;
3590
3591         BT_DBG("%s", hdev->name);
3592
3593         hci_dev_lock(hdev);
3594
3595         if (!hdev_is_powered(hdev)) {
3596                 err = mgmt_cmd_complete(sk, hdev->id,
3597                                         MGMT_OP_START_SERVICE_DISCOVERY,
3598                                         MGMT_STATUS_NOT_POWERED,
3599                                         &cp->type, sizeof(cp->type));
3600                 goto failed;
3601         }
3602
3603         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3604             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3605                 err = mgmt_cmd_complete(sk, hdev->id,
3606                                         MGMT_OP_START_SERVICE_DISCOVERY,
3607                                         MGMT_STATUS_BUSY, &cp->type,
3608                                         sizeof(cp->type));
3609                 goto failed;
3610         }
3611
3612         uuid_count = __le16_to_cpu(cp->uuid_count);
3613         if (uuid_count > max_uuid_count) {
3614                 BT_ERR("service_discovery: too big uuid_count value %u",
3615                        uuid_count);
3616                 err = mgmt_cmd_complete(sk, hdev->id,
3617                                         MGMT_OP_START_SERVICE_DISCOVERY,
3618                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3619                                         sizeof(cp->type));
3620                 goto failed;
3621         }
3622
3623         expected_len = sizeof(*cp) + uuid_count * 16;
3624         if (expected_len != len) {
3625                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
3626                        expected_len, len);
3627                 err = mgmt_cmd_complete(sk, hdev->id,
3628                                         MGMT_OP_START_SERVICE_DISCOVERY,
3629                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
3630                                         sizeof(cp->type));
3631                 goto failed;
3632         }
3633
3634         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3635                 err = mgmt_cmd_complete(sk, hdev->id,
3636                                         MGMT_OP_START_SERVICE_DISCOVERY,
3637                                         status, &cp->type, sizeof(cp->type));
3638                 goto failed;
3639         }
3640
3641         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3642                                hdev, data, len);
3643         if (!cmd) {
3644                 err = -ENOMEM;
3645                 goto failed;
3646         }
3647
3648         cmd->cmd_complete = service_discovery_cmd_complete;
3649
3650         /* Clear the discovery filter first to free any previously
3651          * allocated memory for the UUID list.
3652          */
3653         hci_discovery_filter_clear(hdev);
3654
3655         hdev->discovery.result_filtering = true;
3656         hdev->discovery.type = cp->type;
3657         hdev->discovery.rssi = cp->rssi;
3658         hdev->discovery.uuid_count = uuid_count;
3659
3660         if (uuid_count > 0) {
3661                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
3662                                                 GFP_KERNEL);
3663                 if (!hdev->discovery.uuids) {
3664                         err = mgmt_cmd_complete(sk, hdev->id,
3665                                                 MGMT_OP_START_SERVICE_DISCOVERY,
3666                                                 MGMT_STATUS_FAILED,
3667                                                 &cp->type, sizeof(cp->type));
3668                         mgmt_pending_remove(cmd);
3669                         goto failed;
3670                 }
3671         }
3672
3673         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3674         queue_work(hdev->req_workqueue, &hdev->discov_update);
3675         err = 0;
3676
3677 failed:
3678         hci_dev_unlock(hdev);
3679         return err;
3680 }
3681
3682 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
3683 {
3684         struct mgmt_pending_cmd *cmd;
3685
3686         BT_DBG("status %d", status);
3687
3688         hci_dev_lock(hdev);
3689
3690         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3691         if (cmd) {
3692                 cmd->cmd_complete(cmd, mgmt_status(status));
3693                 mgmt_pending_remove(cmd);
3694         }
3695
3696         hci_dev_unlock(hdev);
3697 }
3698
3699 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3700                           u16 len)
3701 {
3702         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3703         struct mgmt_pending_cmd *cmd;
3704         int err;
3705
3706         BT_DBG("%s", hdev->name);
3707
3708         hci_dev_lock(hdev);
3709
3710         if (!hci_discovery_active(hdev)) {
3711                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3712                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
3713                                         sizeof(mgmt_cp->type));
3714                 goto unlock;
3715         }
3716
3717         if (hdev->discovery.type != mgmt_cp->type) {
3718                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3719                                         MGMT_STATUS_INVALID_PARAMS,
3720                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
3721                 goto unlock;
3722         }
3723
3724         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
3725         if (!cmd) {
3726                 err = -ENOMEM;
3727                 goto unlock;
3728         }
3729
3730         cmd->cmd_complete = generic_cmd_complete;
3731
3732         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3733         queue_work(hdev->req_workqueue, &hdev->discov_update);
3734         err = 0;
3735
3736 unlock:
3737         hci_dev_unlock(hdev);
3738         return err;
3739 }
3740
3741 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3742                         u16 len)
3743 {
3744         struct mgmt_cp_confirm_name *cp = data;
3745         struct inquiry_entry *e;
3746         int err;
3747
3748         BT_DBG("%s", hdev->name);
3749
3750         hci_dev_lock(hdev);
3751
3752         if (!hci_discovery_active(hdev)) {
3753                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3754                                         MGMT_STATUS_FAILED, &cp->addr,
3755                                         sizeof(cp->addr));
3756                 goto failed;
3757         }
3758
3759         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3760         if (!e) {
3761                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3762                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3763                                         sizeof(cp->addr));
3764                 goto failed;
3765         }
3766
3767         if (cp->name_known) {
3768                 e->name_state = NAME_KNOWN;
3769                 list_del(&e->list);
3770         } else {
3771                 e->name_state = NAME_NEEDED;
3772                 hci_inquiry_cache_update_resolve(hdev, e);
3773         }
3774
3775         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
3776                                 &cp->addr, sizeof(cp->addr));
3777
3778 failed:
3779         hci_dev_unlock(hdev);
3780         return err;
3781 }
3782
3783 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3784                         u16 len)
3785 {
3786         struct mgmt_cp_block_device *cp = data;
3787         u8 status;
3788         int err;
3789
3790         BT_DBG("%s", hdev->name);
3791
3792         if (!bdaddr_type_is_valid(cp->addr.type))
3793                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3794                                          MGMT_STATUS_INVALID_PARAMS,
3795                                          &cp->addr, sizeof(cp->addr));
3796
3797         hci_dev_lock(hdev);
3798
3799         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
3800                                   cp->addr.type);
3801         if (err < 0) {
3802                 status = MGMT_STATUS_FAILED;
3803                 goto done;
3804         }
3805
3806         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3807                    sk);
3808         status = MGMT_STATUS_SUCCESS;
3809
3810 done:
3811         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3812                                 &cp->addr, sizeof(cp->addr));
3813
3814         hci_dev_unlock(hdev);
3815
3816         return err;
3817 }
3818
3819 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3820                           u16 len)
3821 {
3822         struct mgmt_cp_unblock_device *cp = data;
3823         u8 status;
3824         int err;
3825
3826         BT_DBG("%s", hdev->name);
3827
3828         if (!bdaddr_type_is_valid(cp->addr.type))
3829                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3830                                          MGMT_STATUS_INVALID_PARAMS,
3831                                          &cp->addr, sizeof(cp->addr));
3832
3833         hci_dev_lock(hdev);
3834
3835         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
3836                                   cp->addr.type);
3837         if (err < 0) {
3838                 status = MGMT_STATUS_INVALID_PARAMS;
3839                 goto done;
3840         }
3841
3842         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3843                    sk);
3844         status = MGMT_STATUS_SUCCESS;
3845
3846 done:
3847         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3848                                 &cp->addr, sizeof(cp->addr));
3849
3850         hci_dev_unlock(hdev);
3851
3852         return err;
3853 }
3854
3855 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3856                          u16 len)
3857 {
3858         struct mgmt_cp_set_device_id *cp = data;
3859         struct hci_request req;
3860         int err;
3861         __u16 source;
3862
3863         BT_DBG("%s", hdev->name);
3864
3865         source = __le16_to_cpu(cp->source);
3866
3867         if (source > 0x0002)
3868                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3869                                        MGMT_STATUS_INVALID_PARAMS);
3870
3871         hci_dev_lock(hdev);
3872
3873         hdev->devid_source = source;
3874         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3875         hdev->devid_product = __le16_to_cpu(cp->product);
3876         hdev->devid_version = __le16_to_cpu(cp->version);
3877
3878         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
3879                                 NULL, 0);
3880
3881         hci_req_init(&req, hdev);
3882         __hci_req_update_eir(&req);
3883         hci_req_run(&req, NULL);
3884
3885         hci_dev_unlock(hdev);
3886
3887         return err;
3888 }
3889
3890 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
3891                                         u16 opcode)
3892 {
3893         BT_DBG("status %d", status);
3894 }
3895
3896 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
3897                                      u16 opcode)
3898 {
3899         struct cmd_lookup match = { NULL, hdev };
3900         struct hci_request req;
3901         u8 instance;
3902         struct adv_info *adv_instance;
3903         int err;
3904
3905         hci_dev_lock(hdev);
3906
3907         if (status) {
3908                 u8 mgmt_err = mgmt_status(status);
3909
3910                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3911                                      cmd_status_rsp, &mgmt_err);
3912                 goto unlock;
3913         }
3914
3915         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3916                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
3917         else
3918                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
3919
3920         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3921                              &match);
3922
3923         new_settings(hdev, match.sk);
3924
3925         if (match.sk)
3926                 sock_put(match.sk);
3927
3928         /* If "Set Advertising" was just disabled and instance advertising was
3929          * set up earlier, then re-enable multi-instance advertising.
3930          */
3931         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
3932             list_empty(&hdev->adv_instances))
3933                 goto unlock;
3934
3935         instance = hdev->cur_adv_instance;
3936         if (!instance) {
3937                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
3938                                                         struct adv_info, list);
3939                 if (!adv_instance)
3940                         goto unlock;
3941
3942                 instance = adv_instance->instance;
3943         }
3944
3945         hci_req_init(&req, hdev);
3946
3947         err = __hci_req_schedule_adv_instance(&req, instance, true);
3948
3949         if (!err)
3950                 err = hci_req_run(&req, enable_advertising_instance);
3951
3952         if (err)
3953                 BT_ERR("Failed to re-configure advertising");
3954
3955 unlock:
3956         hci_dev_unlock(hdev);
3957 }
3958
3959 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3960                            u16 len)
3961 {
3962         struct mgmt_mode *cp = data;
3963         struct mgmt_pending_cmd *cmd;
3964         struct hci_request req;
3965         u8 val, status;
3966         int err;
3967
3968         BT_DBG("request for %s", hdev->name);
3969
3970         status = mgmt_le_support(hdev);
3971         if (status)
3972                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3973                                        status);
3974
3975         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
3976                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3977                                        MGMT_STATUS_INVALID_PARAMS);
3978
3979         hci_dev_lock(hdev);
3980
3981         val = !!cp->val;
3982
3983         /* The following conditions are ones which mean that we should
3984          * not do any HCI communication but directly send a mgmt
3985          * response to user space (after toggling the flag if
3986          * necessary).
3987          */
3988         if (!hdev_is_powered(hdev) ||
3989             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
3990              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
3991             hci_conn_num(hdev, LE_LINK) > 0 ||
3992             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
3993              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
3994                 bool changed;
3995
3996                 if (cp->val) {
3997                         hdev->cur_adv_instance = 0x00;
3998                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
3999                         if (cp->val == 0x02)
4000                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4001                         else
4002                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4003                 } else {
4004                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4005                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4006                 }
4007
4008                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4009                 if (err < 0)
4010                         goto unlock;
4011
4012                 if (changed)
4013                         err = new_settings(hdev, sk);
4014
4015                 goto unlock;
4016         }
4017
4018         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4019             pending_find(MGMT_OP_SET_LE, hdev)) {
4020                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4021                                       MGMT_STATUS_BUSY);
4022                 goto unlock;
4023         }
4024
4025         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4026         if (!cmd) {
4027                 err = -ENOMEM;
4028                 goto unlock;
4029         }
4030
4031         hci_req_init(&req, hdev);
4032
4033         if (cp->val == 0x02)
4034                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4035         else
4036                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4037
4038         cancel_adv_timeout(hdev);
4039
4040         if (val) {
4041                 /* Switch to instance "0" for the Set Advertising setting.
4042                  * We cannot use update_[adv|scan_rsp]_data() here as the
4043                  * HCI_ADVERTISING flag is not yet set.
4044                  */
4045                 hdev->cur_adv_instance = 0x00;
4046                 __hci_req_update_adv_data(&req, 0x00);
4047                 __hci_req_update_scan_rsp_data(&req, 0x00);
4048                 __hci_req_enable_advertising(&req);
4049         } else {
4050                 __hci_req_disable_advertising(&req);
4051         }
4052
4053         err = hci_req_run(&req, set_advertising_complete);
4054         if (err < 0)
4055                 mgmt_pending_remove(cmd);
4056
4057 unlock:
4058         hci_dev_unlock(hdev);
4059         return err;
4060 }
4061
4062 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4063                               void *data, u16 len)
4064 {
4065         struct mgmt_cp_set_static_address *cp = data;
4066         int err;
4067
4068         BT_DBG("%s", hdev->name);
4069
4070         if (!lmp_le_capable(hdev))
4071                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4072                                        MGMT_STATUS_NOT_SUPPORTED);
4073
4074         if (hdev_is_powered(hdev))
4075                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4076                                        MGMT_STATUS_REJECTED);
4077
4078         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4079                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4080                         return mgmt_cmd_status(sk, hdev->id,
4081                                                MGMT_OP_SET_STATIC_ADDRESS,
4082                                                MGMT_STATUS_INVALID_PARAMS);
4083
4084                 /* Two most significant bits shall be set */
4085                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4086                         return mgmt_cmd_status(sk, hdev->id,
4087                                                MGMT_OP_SET_STATIC_ADDRESS,
4088                                                MGMT_STATUS_INVALID_PARAMS);
4089         }
4090
4091         hci_dev_lock(hdev);
4092
4093         bacpy(&hdev->static_addr, &cp->bdaddr);
4094
4095         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4096         if (err < 0)
4097                 goto unlock;
4098
4099         err = new_settings(hdev, sk);
4100
4101 unlock:
4102         hci_dev_unlock(hdev);
4103         return err;
4104 }
4105
4106 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4107                            void *data, u16 len)
4108 {
4109         struct mgmt_cp_set_scan_params *cp = data;
4110         __u16 interval, window;
4111         int err;
4112
4113         BT_DBG("%s", hdev->name);
4114
4115         if (!lmp_le_capable(hdev))
4116                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4117                                        MGMT_STATUS_NOT_SUPPORTED);
4118
4119         interval = __le16_to_cpu(cp->interval);
4120
4121         if (interval < 0x0004 || interval > 0x4000)
4122                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4123                                        MGMT_STATUS_INVALID_PARAMS);
4124
4125         window = __le16_to_cpu(cp->window);
4126
4127         if (window < 0x0004 || window > 0x4000)
4128                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4129                                        MGMT_STATUS_INVALID_PARAMS);
4130
4131         if (window > interval)
4132                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4133                                        MGMT_STATUS_INVALID_PARAMS);
4134
4135         hci_dev_lock(hdev);
4136
4137         hdev->le_scan_interval = interval;
4138         hdev->le_scan_window = window;
4139
4140         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4141                                 NULL, 0);
4142
4143         /* If background scan is running, restart it so new parameters are
4144          * loaded.
4145          */
4146         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4147             hdev->discovery.state == DISCOVERY_STOPPED) {
4148                 struct hci_request req;
4149
4150                 hci_req_init(&req, hdev);
4151
4152                 hci_req_add_le_scan_disable(&req);
4153                 hci_req_add_le_passive_scan(&req);
4154
4155                 hci_req_run(&req, NULL);
4156         }
4157
4158         hci_dev_unlock(hdev);
4159
4160         return err;
4161 }
4162
4163 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4164                                       u16 opcode)
4165 {
4166         struct mgmt_pending_cmd *cmd;
4167
4168         BT_DBG("status 0x%02x", status);
4169
4170         hci_dev_lock(hdev);
4171
4172         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4173         if (!cmd)
4174                 goto unlock;
4175
4176         if (status) {
4177                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4178                                 mgmt_status(status));
4179         } else {
4180                 struct mgmt_mode *cp = cmd->param;
4181
4182                 if (cp->val)
4183                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4184                 else
4185                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4186
4187                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4188                 new_settings(hdev, cmd->sk);
4189         }
4190
4191         mgmt_pending_remove(cmd);
4192
4193 unlock:
4194         hci_dev_unlock(hdev);
4195 }
4196
4197 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4198                                 void *data, u16 len)
4199 {
4200         struct mgmt_mode *cp = data;
4201         struct mgmt_pending_cmd *cmd;
4202         struct hci_request req;
4203         int err;
4204
4205         BT_DBG("%s", hdev->name);
4206
4207         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4208             hdev->hci_ver < BLUETOOTH_VER_1_2)
4209                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4210                                        MGMT_STATUS_NOT_SUPPORTED);
4211
4212         if (cp->val != 0x00 && cp->val != 0x01)
4213                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4214                                        MGMT_STATUS_INVALID_PARAMS);
4215
4216         hci_dev_lock(hdev);
4217
4218         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4219                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4220                                       MGMT_STATUS_BUSY);
4221                 goto unlock;
4222         }
4223
4224         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4225                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4226                                         hdev);
4227                 goto unlock;
4228         }
4229
4230         if (!hdev_is_powered(hdev)) {
4231                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4232                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4233                                         hdev);
4234                 new_settings(hdev, sk);
4235                 goto unlock;
4236         }
4237
4238         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4239                                data, len);
4240         if (!cmd) {
4241                 err = -ENOMEM;
4242                 goto unlock;
4243         }
4244
4245         hci_req_init(&req, hdev);
4246
4247         __hci_req_write_fast_connectable(&req, cp->val);
4248
4249         err = hci_req_run(&req, fast_connectable_complete);
4250         if (err < 0) {
4251                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4252                                       MGMT_STATUS_FAILED);
4253                 mgmt_pending_remove(cmd);
4254         }
4255
4256 unlock:
4257         hci_dev_unlock(hdev);
4258
4259         return err;
4260 }
4261
4262 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4263 {
4264         struct mgmt_pending_cmd *cmd;
4265
4266         BT_DBG("status 0x%02x", status);
4267
4268         hci_dev_lock(hdev);
4269
4270         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4271         if (!cmd)
4272                 goto unlock;
4273
4274         if (status) {
4275                 u8 mgmt_err = mgmt_status(status);
4276
4277                 /* We need to restore the flag if related HCI commands
4278                  * failed.
4279                  */
4280                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4281
4282                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4283         } else {
4284                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4285                 new_settings(hdev, cmd->sk);
4286         }
4287
4288         mgmt_pending_remove(cmd);
4289
4290 unlock:
4291         hci_dev_unlock(hdev);
4292 }
4293
4294 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4295 {
4296         struct mgmt_mode *cp = data;
4297         struct mgmt_pending_cmd *cmd;
4298         struct hci_request req;
4299         int err;
4300
4301         BT_DBG("request for %s", hdev->name);
4302
4303         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4304                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4305                                        MGMT_STATUS_NOT_SUPPORTED);
4306
4307         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4308                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4309                                        MGMT_STATUS_REJECTED);
4310
4311         if (cp->val != 0x00 && cp->val != 0x01)
4312                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4313                                        MGMT_STATUS_INVALID_PARAMS);
4314
4315         hci_dev_lock(hdev);
4316
4317         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4318                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4319                 goto unlock;
4320         }
4321
4322         if (!hdev_is_powered(hdev)) {
4323                 if (!cp->val) {
4324                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4325                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4326                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4327                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4328                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4329                 }
4330
4331                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4332
4333                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4334                 if (err < 0)
4335                         goto unlock;
4336
4337                 err = new_settings(hdev, sk);
4338                 goto unlock;
4339         }
4340
4341         /* Reject disabling when powered on */
4342         if (!cp->val) {
4343                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4344                                       MGMT_STATUS_REJECTED);
4345                 goto unlock;
4346         } else {
4347                 /* When configuring a dual-mode controller to operate
4348                  * with LE only and using a static address, then switching
4349                  * BR/EDR back on is not allowed.
4350                  *
4351                  * Dual-mode controllers shall operate with the public
4352                  * address as its identity address for BR/EDR and LE. So
4353                  * reject the attempt to create an invalid configuration.
4354                  *
4355                  * The same restrictions applies when secure connections
4356                  * has been enabled. For BR/EDR this is a controller feature
4357                  * while for LE it is a host stack feature. This means that
4358                  * switching BR/EDR back on when secure connections has been
4359                  * enabled is not a supported transaction.
4360                  */
4361                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4362                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4363                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4364                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4365                                               MGMT_STATUS_REJECTED);
4366                         goto unlock;
4367                 }
4368         }
4369
4370         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4371                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4372                                       MGMT_STATUS_BUSY);
4373                 goto unlock;
4374         }
4375
4376         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4377         if (!cmd) {
4378                 err = -ENOMEM;
4379                 goto unlock;
4380         }
4381
4382         /* We need to flip the bit already here so that
4383          * hci_req_update_adv_data generates the correct flags.
4384          */
4385         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4386
4387         hci_req_init(&req, hdev);
4388
4389         __hci_req_write_fast_connectable(&req, false);
4390         __hci_req_update_scan(&req);
4391
4392         /* Since only the advertising data flags will change, there
4393          * is no need to update the scan response data.
4394          */
4395         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4396
4397         err = hci_req_run(&req, set_bredr_complete);
4398         if (err < 0)
4399                 mgmt_pending_remove(cmd);
4400
4401 unlock:
4402         hci_dev_unlock(hdev);
4403         return err;
4404 }
4405
4406 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4407 {
4408         struct mgmt_pending_cmd *cmd;
4409         struct mgmt_mode *cp;
4410
4411         BT_DBG("%s status %u", hdev->name, status);
4412
4413         hci_dev_lock(hdev);
4414
4415         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4416         if (!cmd)
4417                 goto unlock;
4418
4419         if (status) {
4420                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4421                                 mgmt_status(status));
4422                 goto remove;
4423         }
4424
4425         cp = cmd->param;
4426
4427         switch (cp->val) {
4428         case 0x00:
4429                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4430                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4431                 break;
4432         case 0x01:
4433                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4434                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4435                 break;
4436         case 0x02:
4437                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4438                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4439                 break;
4440         }
4441
4442         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4443         new_settings(hdev, cmd->sk);
4444
4445 remove:
4446         mgmt_pending_remove(cmd);
4447 unlock:
4448         hci_dev_unlock(hdev);
4449 }
4450
4451 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4452                            void *data, u16 len)
4453 {
4454         struct mgmt_mode *cp = data;
4455         struct mgmt_pending_cmd *cmd;
4456         struct hci_request req;
4457         u8 val;
4458         int err;
4459
4460         BT_DBG("request for %s", hdev->name);
4461
4462         if (!lmp_sc_capable(hdev) &&
4463             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4464                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4465                                        MGMT_STATUS_NOT_SUPPORTED);
4466
4467         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4468             lmp_sc_capable(hdev) &&
4469             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4470                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4471                                        MGMT_STATUS_REJECTED);
4472
4473         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4474                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4475                                   MGMT_STATUS_INVALID_PARAMS);
4476
4477         hci_dev_lock(hdev);
4478
4479         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4480             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4481                 bool changed;
4482
4483                 if (cp->val) {
4484                         changed = !hci_dev_test_and_set_flag(hdev,
4485                                                              HCI_SC_ENABLED);
4486                         if (cp->val == 0x02)
4487                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4488                         else
4489                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4490                 } else {
4491                         changed = hci_dev_test_and_clear_flag(hdev,
4492                                                               HCI_SC_ENABLED);
4493                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4494                 }
4495
4496                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4497                 if (err < 0)
4498                         goto failed;
4499
4500                 if (changed)
4501                         err = new_settings(hdev, sk);
4502
4503                 goto failed;
4504         }
4505
4506         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4507                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4508                                       MGMT_STATUS_BUSY);
4509                 goto failed;
4510         }
4511
4512         val = !!cp->val;
4513
4514         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4515             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4516                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4517                 goto failed;
4518         }
4519
4520         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4521         if (!cmd) {
4522                 err = -ENOMEM;
4523                 goto failed;
4524         }
4525
4526         hci_req_init(&req, hdev);
4527         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4528         err = hci_req_run(&req, sc_enable_complete);
4529         if (err < 0) {
4530                 mgmt_pending_remove(cmd);
4531                 goto failed;
4532         }
4533
4534 failed:
4535         hci_dev_unlock(hdev);
4536         return err;
4537 }
4538
4539 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4540                           void *data, u16 len)
4541 {
4542         struct mgmt_mode *cp = data;
4543         bool changed, use_changed;
4544         int err;
4545
4546         BT_DBG("request for %s", hdev->name);
4547
4548         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4549                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4550                                        MGMT_STATUS_INVALID_PARAMS);
4551
4552         hci_dev_lock(hdev);
4553
4554         if (cp->val)
4555                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4556         else
4557                 changed = hci_dev_test_and_clear_flag(hdev,
4558                                                       HCI_KEEP_DEBUG_KEYS);
4559
4560         if (cp->val == 0x02)
4561                 use_changed = !hci_dev_test_and_set_flag(hdev,
4562                                                          HCI_USE_DEBUG_KEYS);
4563         else
4564                 use_changed = hci_dev_test_and_clear_flag(hdev,
4565                                                           HCI_USE_DEBUG_KEYS);
4566
4567         if (hdev_is_powered(hdev) && use_changed &&
4568             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4569                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4570                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4571                              sizeof(mode), &mode);
4572         }
4573
4574         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4575         if (err < 0)
4576                 goto unlock;
4577
4578         if (changed)
4579                 err = new_settings(hdev, sk);
4580
4581 unlock:
4582         hci_dev_unlock(hdev);
4583         return err;
4584 }
4585
4586 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4587                        u16 len)
4588 {
4589         struct mgmt_cp_set_privacy *cp = cp_data;
4590         bool changed;
4591         int err;
4592
4593         BT_DBG("request for %s", hdev->name);
4594
4595         if (!lmp_le_capable(hdev))
4596                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4597                                        MGMT_STATUS_NOT_SUPPORTED);
4598
4599         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4600                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4601                                        MGMT_STATUS_INVALID_PARAMS);
4602
4603         if (hdev_is_powered(hdev))
4604                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4605                                        MGMT_STATUS_REJECTED);
4606
4607         hci_dev_lock(hdev);
4608
4609         /* If user space supports this command it is also expected to
4610          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4611          */
4612         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4613
4614         if (cp->privacy) {
4615                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4616                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4617                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4618                 if (cp->privacy == 0x02)
4619                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4620                 else
4621                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4622         } else {
4623                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4624                 memset(hdev->irk, 0, sizeof(hdev->irk));
4625                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4626                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4627         }
4628
4629         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4630         if (err < 0)
4631                 goto unlock;
4632
4633         if (changed)
4634                 err = new_settings(hdev, sk);
4635
4636 unlock:
4637         hci_dev_unlock(hdev);
4638         return err;
4639 }
4640
4641 static bool irk_is_valid(struct mgmt_irk_info *irk)
4642 {
4643         switch (irk->addr.type) {
4644         case BDADDR_LE_PUBLIC:
4645                 return true;
4646
4647         case BDADDR_LE_RANDOM:
4648                 /* Two most significant bits shall be set */
4649                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4650                         return false;
4651                 return true;
4652         }
4653
4654         return false;
4655 }
4656
4657 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4658                      u16 len)
4659 {
4660         struct mgmt_cp_load_irks *cp = cp_data;
4661         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4662                                    sizeof(struct mgmt_irk_info));
4663         u16 irk_count, expected_len;
4664         int i, err;
4665
4666         BT_DBG("request for %s", hdev->name);
4667
4668         if (!lmp_le_capable(hdev))
4669                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4670                                        MGMT_STATUS_NOT_SUPPORTED);
4671
4672         irk_count = __le16_to_cpu(cp->irk_count);
4673         if (irk_count > max_irk_count) {
4674                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4675                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4676                                        MGMT_STATUS_INVALID_PARAMS);
4677         }
4678
4679         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4680         if (expected_len != len) {
4681                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4682                        expected_len, len);
4683                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4684                                        MGMT_STATUS_INVALID_PARAMS);
4685         }
4686
4687         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4688
4689         for (i = 0; i < irk_count; i++) {
4690                 struct mgmt_irk_info *key = &cp->irks[i];
4691
4692                 if (!irk_is_valid(key))
4693                         return mgmt_cmd_status(sk, hdev->id,
4694                                                MGMT_OP_LOAD_IRKS,
4695                                                MGMT_STATUS_INVALID_PARAMS);
4696         }
4697
4698         hci_dev_lock(hdev);
4699
4700         hci_smp_irks_clear(hdev);
4701
4702         for (i = 0; i < irk_count; i++) {
4703                 struct mgmt_irk_info *irk = &cp->irks[i];
4704
4705                 hci_add_irk(hdev, &irk->addr.bdaddr,
4706                             le_addr_type(irk->addr.type), irk->val,
4707                             BDADDR_ANY);
4708         }
4709
4710         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4711
4712         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4713
4714         hci_dev_unlock(hdev);
4715
4716         return err;
4717 }
4718
4719 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4720 {
4721         if (key->master != 0x00 && key->master != 0x01)
4722                 return false;
4723
4724         switch (key->addr.type) {
4725         case BDADDR_LE_PUBLIC:
4726                 return true;
4727
4728         case BDADDR_LE_RANDOM:
4729                 /* Two most significant bits shall be set */
4730                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4731                         return false;
4732                 return true;
4733         }
4734
4735         return false;
4736 }
4737
4738 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4739                                void *cp_data, u16 len)
4740 {
4741         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4742         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4743                                    sizeof(struct mgmt_ltk_info));
4744         u16 key_count, expected_len;
4745         int i, err;
4746
4747         BT_DBG("request for %s", hdev->name);
4748
4749         if (!lmp_le_capable(hdev))
4750                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4751                                        MGMT_STATUS_NOT_SUPPORTED);
4752
4753         key_count = __le16_to_cpu(cp->key_count);
4754         if (key_count > max_key_count) {
4755                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4756                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4757                                        MGMT_STATUS_INVALID_PARAMS);
4758         }
4759
4760         expected_len = sizeof(*cp) + key_count *
4761                                         sizeof(struct mgmt_ltk_info);
4762         if (expected_len != len) {
4763                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4764                        expected_len, len);
4765                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4766                                        MGMT_STATUS_INVALID_PARAMS);
4767         }
4768
4769         BT_DBG("%s key_count %u", hdev->name, key_count);
4770
4771         for (i = 0; i < key_count; i++) {
4772                 struct mgmt_ltk_info *key = &cp->keys[i];
4773
4774                 if (!ltk_is_valid(key))
4775                         return mgmt_cmd_status(sk, hdev->id,
4776                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
4777                                                MGMT_STATUS_INVALID_PARAMS);
4778         }
4779
4780         hci_dev_lock(hdev);
4781
4782         hci_smp_ltks_clear(hdev);
4783
4784         for (i = 0; i < key_count; i++) {
4785                 struct mgmt_ltk_info *key = &cp->keys[i];
4786                 u8 type, authenticated;
4787
4788                 switch (key->type) {
4789                 case MGMT_LTK_UNAUTHENTICATED:
4790                         authenticated = 0x00;
4791                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
4792                         break;
4793                 case MGMT_LTK_AUTHENTICATED:
4794                         authenticated = 0x01;
4795                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
4796                         break;
4797                 case MGMT_LTK_P256_UNAUTH:
4798                         authenticated = 0x00;
4799                         type = SMP_LTK_P256;
4800                         break;
4801                 case MGMT_LTK_P256_AUTH:
4802                         authenticated = 0x01;
4803                         type = SMP_LTK_P256;
4804                         break;
4805                 case MGMT_LTK_P256_DEBUG:
4806                         authenticated = 0x00;
4807                         type = SMP_LTK_P256_DEBUG;
4808                 default:
4809                         continue;
4810                 }
4811
4812                 hci_add_ltk(hdev, &key->addr.bdaddr,
4813                             le_addr_type(key->addr.type), type, authenticated,
4814                             key->val, key->enc_size, key->ediv, key->rand);
4815         }
4816
4817         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4818                            NULL, 0);
4819
4820         hci_dev_unlock(hdev);
4821
4822         return err;
4823 }
4824
4825 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
4826 {
4827         struct hci_conn *conn = cmd->user_data;
4828         struct mgmt_rp_get_conn_info rp;
4829         int err;
4830
4831         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
4832
4833         if (status == MGMT_STATUS_SUCCESS) {
4834                 rp.rssi = conn->rssi;
4835                 rp.tx_power = conn->tx_power;
4836                 rp.max_tx_power = conn->max_tx_power;
4837         } else {
4838                 rp.rssi = HCI_RSSI_INVALID;
4839                 rp.tx_power = HCI_TX_POWER_INVALID;
4840                 rp.max_tx_power = HCI_TX_POWER_INVALID;
4841         }
4842
4843         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4844                                 status, &rp, sizeof(rp));
4845
4846         hci_conn_drop(conn);
4847         hci_conn_put(conn);
4848
4849         return err;
4850 }
4851
4852 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
4853                                        u16 opcode)
4854 {
4855         struct hci_cp_read_rssi *cp;
4856         struct mgmt_pending_cmd *cmd;
4857         struct hci_conn *conn;
4858         u16 handle;
4859         u8 status;
4860
4861         BT_DBG("status 0x%02x", hci_status);
4862
4863         hci_dev_lock(hdev);
4864
4865         /* Commands sent in request are either Read RSSI or Read Transmit Power
4866          * Level so we check which one was last sent to retrieve connection
4867          * handle.  Both commands have handle as first parameter so it's safe to
4868          * cast data on the same command struct.
4869          *
4870          * First command sent is always Read RSSI and we fail only if it fails.
4871          * In other case we simply override error to indicate success as we
4872          * already remembered if TX power value is actually valid.
4873          */
4874         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4875         if (!cp) {
4876                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4877                 status = MGMT_STATUS_SUCCESS;
4878         } else {
4879                 status = mgmt_status(hci_status);
4880         }
4881
4882         if (!cp) {
4883                 BT_ERR("invalid sent_cmd in conn_info response");
4884                 goto unlock;
4885         }
4886
4887         handle = __le16_to_cpu(cp->handle);
4888         conn = hci_conn_hash_lookup_handle(hdev, handle);
4889         if (!conn) {
4890                 BT_ERR("unknown handle (%d) in conn_info response", handle);
4891                 goto unlock;
4892         }
4893
4894         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
4895         if (!cmd)
4896                 goto unlock;
4897
4898         cmd->cmd_complete(cmd, status);
4899         mgmt_pending_remove(cmd);
4900
4901 unlock:
4902         hci_dev_unlock(hdev);
4903 }
4904
4905 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4906                          u16 len)
4907 {
4908         struct mgmt_cp_get_conn_info *cp = data;
4909         struct mgmt_rp_get_conn_info rp;
4910         struct hci_conn *conn;
4911         unsigned long conn_info_age;
4912         int err = 0;
4913
4914         BT_DBG("%s", hdev->name);
4915
4916         memset(&rp, 0, sizeof(rp));
4917         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4918         rp.addr.type = cp->addr.type;
4919
4920         if (!bdaddr_type_is_valid(cp->addr.type))
4921                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4922                                          MGMT_STATUS_INVALID_PARAMS,
4923                                          &rp, sizeof(rp));
4924
4925         hci_dev_lock(hdev);
4926
4927         if (!hdev_is_powered(hdev)) {
4928                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4929                                         MGMT_STATUS_NOT_POWERED, &rp,
4930                                         sizeof(rp));
4931                 goto unlock;
4932         }
4933
4934         if (cp->addr.type == BDADDR_BREDR)
4935                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4936                                                &cp->addr.bdaddr);
4937         else
4938                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4939
4940         if (!conn || conn->state != BT_CONNECTED) {
4941                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4942                                         MGMT_STATUS_NOT_CONNECTED, &rp,
4943                                         sizeof(rp));
4944                 goto unlock;
4945         }
4946
4947         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
4948                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4949                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
4950                 goto unlock;
4951         }
4952
4953         /* To avoid client trying to guess when to poll again for information we
4954          * calculate conn info age as random value between min/max set in hdev.
4955          */
4956         conn_info_age = hdev->conn_info_min_age +
4957                         prandom_u32_max(hdev->conn_info_max_age -
4958                                         hdev->conn_info_min_age);
4959
4960         /* Query controller to refresh cached values if they are too old or were
4961          * never read.
4962          */
4963         if (time_after(jiffies, conn->conn_info_timestamp +
4964                        msecs_to_jiffies(conn_info_age)) ||
4965             !conn->conn_info_timestamp) {
4966                 struct hci_request req;
4967                 struct hci_cp_read_tx_power req_txp_cp;
4968                 struct hci_cp_read_rssi req_rssi_cp;
4969                 struct mgmt_pending_cmd *cmd;
4970
4971                 hci_req_init(&req, hdev);
4972                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4973                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4974                             &req_rssi_cp);
4975
4976                 /* For LE links TX power does not change thus we don't need to
4977                  * query for it once value is known.
4978                  */
4979                 if (!bdaddr_type_is_le(cp->addr.type) ||
4980                     conn->tx_power == HCI_TX_POWER_INVALID) {
4981                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4982                         req_txp_cp.type = 0x00;
4983                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4984                                     sizeof(req_txp_cp), &req_txp_cp);
4985                 }
4986
4987                 /* Max TX power needs to be read only once per connection */
4988                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4989                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4990                         req_txp_cp.type = 0x01;
4991                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4992                                     sizeof(req_txp_cp), &req_txp_cp);
4993                 }
4994
4995                 err = hci_req_run(&req, conn_info_refresh_complete);
4996                 if (err < 0)
4997                         goto unlock;
4998
4999                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5000                                        data, len);
5001                 if (!cmd) {
5002                         err = -ENOMEM;
5003                         goto unlock;
5004                 }
5005
5006                 hci_conn_hold(conn);
5007                 cmd->user_data = hci_conn_get(conn);
5008                 cmd->cmd_complete = conn_info_cmd_complete;
5009
5010                 conn->conn_info_timestamp = jiffies;
5011         } else {
5012                 /* Cache is valid, just reply with values cached in hci_conn */
5013                 rp.rssi = conn->rssi;
5014                 rp.tx_power = conn->tx_power;
5015                 rp.max_tx_power = conn->max_tx_power;
5016
5017                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5018                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5019         }
5020
5021 unlock:
5022         hci_dev_unlock(hdev);
5023         return err;
5024 }
5025
5026 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5027 {
5028         struct hci_conn *conn = cmd->user_data;
5029         struct mgmt_rp_get_clock_info rp;
5030         struct hci_dev *hdev;
5031         int err;
5032
5033         memset(&rp, 0, sizeof(rp));
5034         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5035
5036         if (status)
5037                 goto complete;
5038
5039         hdev = hci_dev_get(cmd->index);
5040         if (hdev) {
5041                 rp.local_clock = cpu_to_le32(hdev->clock);
5042                 hci_dev_put(hdev);
5043         }
5044
5045         if (conn) {
5046                 rp.piconet_clock = cpu_to_le32(conn->clock);
5047                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5048         }
5049
5050 complete:
5051         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5052                                 sizeof(rp));
5053
5054         if (conn) {
5055                 hci_conn_drop(conn);
5056                 hci_conn_put(conn);
5057         }
5058
5059         return err;
5060 }
5061
5062 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5063 {
5064         struct hci_cp_read_clock *hci_cp;
5065         struct mgmt_pending_cmd *cmd;
5066         struct hci_conn *conn;
5067
5068         BT_DBG("%s status %u", hdev->name, status);
5069
5070         hci_dev_lock(hdev);
5071
5072         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5073         if (!hci_cp)
5074                 goto unlock;
5075
5076         if (hci_cp->which) {
5077                 u16 handle = __le16_to_cpu(hci_cp->handle);
5078                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5079         } else {
5080                 conn = NULL;
5081         }
5082
5083         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5084         if (!cmd)
5085                 goto unlock;
5086
5087         cmd->cmd_complete(cmd, mgmt_status(status));
5088         mgmt_pending_remove(cmd);
5089
5090 unlock:
5091         hci_dev_unlock(hdev);
5092 }
5093
5094 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5095                          u16 len)
5096 {
5097         struct mgmt_cp_get_clock_info *cp = data;
5098         struct mgmt_rp_get_clock_info rp;
5099         struct hci_cp_read_clock hci_cp;
5100         struct mgmt_pending_cmd *cmd;
5101         struct hci_request req;
5102         struct hci_conn *conn;
5103         int err;
5104
5105         BT_DBG("%s", hdev->name);
5106
5107         memset(&rp, 0, sizeof(rp));
5108         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5109         rp.addr.type = cp->addr.type;
5110
5111         if (cp->addr.type != BDADDR_BREDR)
5112                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5113                                          MGMT_STATUS_INVALID_PARAMS,
5114                                          &rp, sizeof(rp));
5115
5116         hci_dev_lock(hdev);
5117
5118         if (!hdev_is_powered(hdev)) {
5119                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5120                                         MGMT_STATUS_NOT_POWERED, &rp,
5121                                         sizeof(rp));
5122                 goto unlock;
5123         }
5124
5125         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5126                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5127                                                &cp->addr.bdaddr);
5128                 if (!conn || conn->state != BT_CONNECTED) {
5129                         err = mgmt_cmd_complete(sk, hdev->id,
5130                                                 MGMT_OP_GET_CLOCK_INFO,
5131                                                 MGMT_STATUS_NOT_CONNECTED,
5132                                                 &rp, sizeof(rp));
5133                         goto unlock;
5134                 }
5135         } else {
5136                 conn = NULL;
5137         }
5138
5139         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5140         if (!cmd) {
5141                 err = -ENOMEM;
5142                 goto unlock;
5143         }
5144
5145         cmd->cmd_complete = clock_info_cmd_complete;
5146
5147         hci_req_init(&req, hdev);
5148
5149         memset(&hci_cp, 0, sizeof(hci_cp));
5150         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5151
5152         if (conn) {
5153                 hci_conn_hold(conn);
5154                 cmd->user_data = hci_conn_get(conn);
5155
5156                 hci_cp.handle = cpu_to_le16(conn->handle);
5157                 hci_cp.which = 0x01; /* Piconet clock */
5158                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5159         }
5160
5161         err = hci_req_run(&req, get_clock_info_complete);
5162         if (err < 0)
5163                 mgmt_pending_remove(cmd);
5164
5165 unlock:
5166         hci_dev_unlock(hdev);
5167         return err;
5168 }
5169
5170 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5171 {
5172         struct hci_conn *conn;
5173
5174         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5175         if (!conn)
5176                 return false;
5177
5178         if (conn->dst_type != type)
5179                 return false;
5180
5181         if (conn->state != BT_CONNECTED)
5182                 return false;
5183
5184         return true;
5185 }
5186
5187 /* This function requires the caller holds hdev->lock */
5188 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5189                                u8 addr_type, u8 auto_connect)
5190 {
5191         struct hci_conn_params *params;
5192
5193         params = hci_conn_params_add(hdev, addr, addr_type);
5194         if (!params)
5195                 return -EIO;
5196
5197         if (params->auto_connect == auto_connect)
5198                 return 0;
5199
5200         list_del_init(&params->action);
5201
5202         switch (auto_connect) {
5203         case HCI_AUTO_CONN_DISABLED:
5204         case HCI_AUTO_CONN_LINK_LOSS:
5205                 /* If auto connect is being disabled when we're trying to
5206                  * connect to device, keep connecting.
5207                  */
5208                 if (params->explicit_connect)
5209                         list_add(&params->action, &hdev->pend_le_conns);
5210                 break;
5211         case HCI_AUTO_CONN_REPORT:
5212                 if (params->explicit_connect)
5213                         list_add(&params->action, &hdev->pend_le_conns);
5214                 else
5215                         list_add(&params->action, &hdev->pend_le_reports);
5216                 break;
5217         case HCI_AUTO_CONN_DIRECT:
5218         case HCI_AUTO_CONN_ALWAYS:
5219                 if (!is_connected(hdev, addr, addr_type))
5220                         list_add(&params->action, &hdev->pend_le_conns);
5221                 break;
5222         }
5223
5224         params->auto_connect = auto_connect;
5225
5226         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5227                auto_connect);
5228
5229         return 0;
5230 }
5231
5232 static void device_added(struct sock *sk, struct hci_dev *hdev,
5233                          bdaddr_t *bdaddr, u8 type, u8 action)
5234 {
5235         struct mgmt_ev_device_added ev;
5236
5237         bacpy(&ev.addr.bdaddr, bdaddr);
5238         ev.addr.type = type;
5239         ev.action = action;
5240
5241         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5242 }
5243
5244 static int add_device(struct sock *sk, struct hci_dev *hdev,
5245                       void *data, u16 len)
5246 {
5247         struct mgmt_cp_add_device *cp = data;
5248         u8 auto_conn, addr_type;
5249         int err;
5250
5251         BT_DBG("%s", hdev->name);
5252
5253         if (!bdaddr_type_is_valid(cp->addr.type) ||
5254             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5255                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5256                                          MGMT_STATUS_INVALID_PARAMS,
5257                                          &cp->addr, sizeof(cp->addr));
5258
5259         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5260                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5261                                          MGMT_STATUS_INVALID_PARAMS,
5262                                          &cp->addr, sizeof(cp->addr));
5263
5264         hci_dev_lock(hdev);
5265
5266         if (cp->addr.type == BDADDR_BREDR) {
5267                 /* Only incoming connections action is supported for now */
5268                 if (cp->action != 0x01) {
5269                         err = mgmt_cmd_complete(sk, hdev->id,
5270                                                 MGMT_OP_ADD_DEVICE,
5271                                                 MGMT_STATUS_INVALID_PARAMS,
5272                                                 &cp->addr, sizeof(cp->addr));
5273                         goto unlock;
5274                 }
5275
5276                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5277                                           cp->addr.type);
5278                 if (err)
5279                         goto unlock;
5280
5281                 hci_req_update_scan(hdev);
5282
5283                 goto added;
5284         }
5285
5286         addr_type = le_addr_type(cp->addr.type);
5287
5288         if (cp->action == 0x02)
5289                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5290         else if (cp->action == 0x01)
5291                 auto_conn = HCI_AUTO_CONN_DIRECT;
5292         else
5293                 auto_conn = HCI_AUTO_CONN_REPORT;
5294
5295         /* Kernel internally uses conn_params with resolvable private
5296          * address, but Add Device allows only identity addresses.
5297          * Make sure it is enforced before calling
5298          * hci_conn_params_lookup.
5299          */
5300         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5301                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5302                                         MGMT_STATUS_INVALID_PARAMS,
5303                                         &cp->addr, sizeof(cp->addr));
5304                 goto unlock;
5305         }
5306
5307         /* If the connection parameters don't exist for this device,
5308          * they will be created and configured with defaults.
5309          */
5310         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5311                                 auto_conn) < 0) {
5312                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5313                                         MGMT_STATUS_FAILED, &cp->addr,
5314                                         sizeof(cp->addr));
5315                 goto unlock;
5316         }
5317
5318         hci_update_background_scan(hdev);
5319
5320 added:
5321         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5322
5323         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5324                                 MGMT_STATUS_SUCCESS, &cp->addr,
5325                                 sizeof(cp->addr));
5326
5327 unlock:
5328         hci_dev_unlock(hdev);
5329         return err;
5330 }
5331
5332 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5333                            bdaddr_t *bdaddr, u8 type)
5334 {
5335         struct mgmt_ev_device_removed ev;
5336
5337         bacpy(&ev.addr.bdaddr, bdaddr);
5338         ev.addr.type = type;
5339
5340         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5341 }
5342
5343 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5344                          void *data, u16 len)
5345 {
5346         struct mgmt_cp_remove_device *cp = data;
5347         int err;
5348
5349         BT_DBG("%s", hdev->name);
5350
5351         hci_dev_lock(hdev);
5352
5353         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5354                 struct hci_conn_params *params;
5355                 u8 addr_type;
5356
5357                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5358                         err = mgmt_cmd_complete(sk, hdev->id,
5359                                                 MGMT_OP_REMOVE_DEVICE,
5360                                                 MGMT_STATUS_INVALID_PARAMS,
5361                                                 &cp->addr, sizeof(cp->addr));
5362                         goto unlock;
5363                 }
5364
5365                 if (cp->addr.type == BDADDR_BREDR) {
5366                         err = hci_bdaddr_list_del(&hdev->whitelist,
5367                                                   &cp->addr.bdaddr,
5368                                                   cp->addr.type);
5369                         if (err) {
5370                                 err = mgmt_cmd_complete(sk, hdev->id,
5371                                                         MGMT_OP_REMOVE_DEVICE,
5372                                                         MGMT_STATUS_INVALID_PARAMS,
5373                                                         &cp->addr,
5374                                                         sizeof(cp->addr));
5375                                 goto unlock;
5376                         }
5377
5378                         hci_req_update_scan(hdev);
5379
5380                         device_removed(sk, hdev, &cp->addr.bdaddr,
5381                                        cp->addr.type);
5382                         goto complete;
5383                 }
5384
5385                 addr_type = le_addr_type(cp->addr.type);
5386
5387                 /* Kernel internally uses conn_params with resolvable private
5388                  * address, but Remove Device allows only identity addresses.
5389                  * Make sure it is enforced before calling
5390                  * hci_conn_params_lookup.
5391                  */
5392                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5393                         err = mgmt_cmd_complete(sk, hdev->id,
5394                                                 MGMT_OP_REMOVE_DEVICE,
5395                                                 MGMT_STATUS_INVALID_PARAMS,
5396                                                 &cp->addr, sizeof(cp->addr));
5397                         goto unlock;
5398                 }
5399
5400                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5401                                                 addr_type);
5402                 if (!params) {
5403                         err = mgmt_cmd_complete(sk, hdev->id,
5404                                                 MGMT_OP_REMOVE_DEVICE,
5405                                                 MGMT_STATUS_INVALID_PARAMS,
5406                                                 &cp->addr, sizeof(cp->addr));
5407                         goto unlock;
5408                 }
5409
5410                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5411                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5412                         err = mgmt_cmd_complete(sk, hdev->id,
5413                                                 MGMT_OP_REMOVE_DEVICE,
5414                                                 MGMT_STATUS_INVALID_PARAMS,
5415                                                 &cp->addr, sizeof(cp->addr));
5416                         goto unlock;
5417                 }
5418
5419                 list_del(&params->action);
5420                 list_del(&params->list);
5421                 kfree(params);
5422                 hci_update_background_scan(hdev);
5423
5424                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5425         } else {
5426                 struct hci_conn_params *p, *tmp;
5427                 struct bdaddr_list *b, *btmp;
5428
5429                 if (cp->addr.type) {
5430                         err = mgmt_cmd_complete(sk, hdev->id,
5431                                                 MGMT_OP_REMOVE_DEVICE,
5432                                                 MGMT_STATUS_INVALID_PARAMS,
5433                                                 &cp->addr, sizeof(cp->addr));
5434                         goto unlock;
5435                 }
5436
5437                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5438                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5439                         list_del(&b->list);
5440                         kfree(b);
5441                 }
5442
5443                 hci_req_update_scan(hdev);
5444
5445                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5446                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5447                                 continue;
5448                         device_removed(sk, hdev, &p->addr, p->addr_type);
5449                         if (p->explicit_connect) {
5450                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5451                                 continue;
5452                         }
5453                         list_del(&p->action);
5454                         list_del(&p->list);
5455                         kfree(p);
5456                 }
5457
5458                 BT_DBG("All LE connection parameters were removed");
5459
5460                 hci_update_background_scan(hdev);
5461         }
5462
5463 complete:
5464         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5465                                 MGMT_STATUS_SUCCESS, &cp->addr,
5466                                 sizeof(cp->addr));
5467 unlock:
5468         hci_dev_unlock(hdev);
5469         return err;
5470 }
5471
5472 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5473                            u16 len)
5474 {
5475         struct mgmt_cp_load_conn_param *cp = data;
5476         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5477                                      sizeof(struct mgmt_conn_param));
5478         u16 param_count, expected_len;
5479         int i;
5480
5481         if (!lmp_le_capable(hdev))
5482                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5483                                        MGMT_STATUS_NOT_SUPPORTED);
5484
5485         param_count = __le16_to_cpu(cp->param_count);
5486         if (param_count > max_param_count) {
5487                 BT_ERR("load_conn_param: too big param_count value %u",
5488                        param_count);
5489                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5490                                        MGMT_STATUS_INVALID_PARAMS);
5491         }
5492
5493         expected_len = sizeof(*cp) + param_count *
5494                                         sizeof(struct mgmt_conn_param);
5495         if (expected_len != len) {
5496                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5497                        expected_len, len);
5498                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5499                                        MGMT_STATUS_INVALID_PARAMS);
5500         }
5501
5502         BT_DBG("%s param_count %u", hdev->name, param_count);
5503
5504         hci_dev_lock(hdev);
5505
5506         hci_conn_params_clear_disabled(hdev);
5507
5508         for (i = 0; i < param_count; i++) {
5509                 struct mgmt_conn_param *param = &cp->params[i];
5510                 struct hci_conn_params *hci_param;
5511                 u16 min, max, latency, timeout;
5512                 u8 addr_type;
5513
5514                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5515                        param->addr.type);
5516
5517                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5518                         addr_type = ADDR_LE_DEV_PUBLIC;
5519                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5520                         addr_type = ADDR_LE_DEV_RANDOM;
5521                 } else {
5522                         BT_ERR("Ignoring invalid connection parameters");
5523                         continue;
5524                 }
5525
5526                 min = le16_to_cpu(param->min_interval);
5527                 max = le16_to_cpu(param->max_interval);
5528                 latency = le16_to_cpu(param->latency);
5529                 timeout = le16_to_cpu(param->timeout);
5530
5531                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5532                        min, max, latency, timeout);
5533
5534                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5535                         BT_ERR("Ignoring invalid connection parameters");
5536                         continue;
5537                 }
5538
5539                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5540                                                 addr_type);
5541                 if (!hci_param) {
5542                         BT_ERR("Failed to add connection parameters");
5543                         continue;
5544                 }
5545
5546                 hci_param->conn_min_interval = min;
5547                 hci_param->conn_max_interval = max;
5548                 hci_param->conn_latency = latency;
5549                 hci_param->supervision_timeout = timeout;
5550         }
5551
5552         hci_dev_unlock(hdev);
5553
5554         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5555                                  NULL, 0);
5556 }
5557
5558 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5559                                void *data, u16 len)
5560 {
5561         struct mgmt_cp_set_external_config *cp = data;
5562         bool changed;
5563         int err;
5564
5565         BT_DBG("%s", hdev->name);
5566
5567         if (hdev_is_powered(hdev))
5568                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5569                                        MGMT_STATUS_REJECTED);
5570
5571         if (cp->config != 0x00 && cp->config != 0x01)
5572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5573                                          MGMT_STATUS_INVALID_PARAMS);
5574
5575         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5576                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5577                                        MGMT_STATUS_NOT_SUPPORTED);
5578
5579         hci_dev_lock(hdev);
5580
5581         if (cp->config)
5582                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5583         else
5584                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5585
5586         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5587         if (err < 0)
5588                 goto unlock;
5589
5590         if (!changed)
5591                 goto unlock;
5592
5593         err = new_options(hdev, sk);
5594
5595         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5596                 mgmt_index_removed(hdev);
5597
5598                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5599                         hci_dev_set_flag(hdev, HCI_CONFIG);
5600                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5601
5602                         queue_work(hdev->req_workqueue, &hdev->power_on);
5603                 } else {
5604                         set_bit(HCI_RAW, &hdev->flags);
5605                         mgmt_index_added(hdev);
5606                 }
5607         }
5608
5609 unlock:
5610         hci_dev_unlock(hdev);
5611         return err;
5612 }
5613
5614 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5615                               void *data, u16 len)
5616 {
5617         struct mgmt_cp_set_public_address *cp = data;
5618         bool changed;
5619         int err;
5620
5621         BT_DBG("%s", hdev->name);
5622
5623         if (hdev_is_powered(hdev))
5624                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5625                                        MGMT_STATUS_REJECTED);
5626
5627         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5628                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5629                                        MGMT_STATUS_INVALID_PARAMS);
5630
5631         if (!hdev->set_bdaddr)
5632                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5633                                        MGMT_STATUS_NOT_SUPPORTED);
5634
5635         hci_dev_lock(hdev);
5636
5637         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5638         bacpy(&hdev->public_addr, &cp->bdaddr);
5639
5640         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5641         if (err < 0)
5642                 goto unlock;
5643
5644         if (!changed)
5645                 goto unlock;
5646
5647         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5648                 err = new_options(hdev, sk);
5649
5650         if (is_configured(hdev)) {
5651                 mgmt_index_removed(hdev);
5652
5653                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
5654
5655                 hci_dev_set_flag(hdev, HCI_CONFIG);
5656                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5657
5658                 queue_work(hdev->req_workqueue, &hdev->power_on);
5659         }
5660
5661 unlock:
5662         hci_dev_unlock(hdev);
5663         return err;
5664 }
5665
5666 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
5667                                              u16 opcode, struct sk_buff *skb)
5668 {
5669         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
5670         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
5671         u8 *h192, *r192, *h256, *r256;
5672         struct mgmt_pending_cmd *cmd;
5673         u16 eir_len;
5674         int err;
5675
5676         BT_DBG("%s status %u", hdev->name, status);
5677
5678         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
5679         if (!cmd)
5680                 return;
5681
5682         mgmt_cp = cmd->param;
5683
5684         if (status) {
5685                 status = mgmt_status(status);
5686                 eir_len = 0;
5687
5688                 h192 = NULL;
5689                 r192 = NULL;
5690                 h256 = NULL;
5691                 r256 = NULL;
5692         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
5693                 struct hci_rp_read_local_oob_data *rp;
5694
5695                 if (skb->len != sizeof(*rp)) {
5696                         status = MGMT_STATUS_FAILED;
5697                         eir_len = 0;
5698                 } else {
5699                         status = MGMT_STATUS_SUCCESS;
5700                         rp = (void *)skb->data;
5701
5702                         eir_len = 5 + 18 + 18;
5703                         h192 = rp->hash;
5704                         r192 = rp->rand;
5705                         h256 = NULL;
5706                         r256 = NULL;
5707                 }
5708         } else {
5709                 struct hci_rp_read_local_oob_ext_data *rp;
5710
5711                 if (skb->len != sizeof(*rp)) {
5712                         status = MGMT_STATUS_FAILED;
5713                         eir_len = 0;
5714                 } else {
5715                         status = MGMT_STATUS_SUCCESS;
5716                         rp = (void *)skb->data;
5717
5718                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5719                                 eir_len = 5 + 18 + 18;
5720                                 h192 = NULL;
5721                                 r192 = NULL;
5722                         } else {
5723                                 eir_len = 5 + 18 + 18 + 18 + 18;
5724                                 h192 = rp->hash192;
5725                                 r192 = rp->rand192;
5726                         }
5727
5728                         h256 = rp->hash256;
5729                         r256 = rp->rand256;
5730                 }
5731         }
5732
5733         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
5734         if (!mgmt_rp)
5735                 goto done;
5736
5737         if (status)
5738                 goto send_rsp;
5739
5740         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
5741                                   hdev->dev_class, 3);
5742
5743         if (h192 && r192) {
5744                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5745                                           EIR_SSP_HASH_C192, h192, 16);
5746                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5747                                           EIR_SSP_RAND_R192, r192, 16);
5748         }
5749
5750         if (h256 && r256) {
5751                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5752                                           EIR_SSP_HASH_C256, h256, 16);
5753                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5754                                           EIR_SSP_RAND_R256, r256, 16);
5755         }
5756
5757 send_rsp:
5758         mgmt_rp->type = mgmt_cp->type;
5759         mgmt_rp->eir_len = cpu_to_le16(eir_len);
5760
5761         err = mgmt_cmd_complete(cmd->sk, hdev->id,
5762                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
5763                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
5764         if (err < 0 || status)
5765                 goto done;
5766
5767         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
5768
5769         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
5770                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
5771                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
5772 done:
5773         kfree(mgmt_rp);
5774         mgmt_pending_remove(cmd);
5775 }
5776
5777 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
5778                                   struct mgmt_cp_read_local_oob_ext_data *cp)
5779 {
5780         struct mgmt_pending_cmd *cmd;
5781         struct hci_request req;
5782         int err;
5783
5784         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
5785                                cp, sizeof(*cp));
5786         if (!cmd)
5787                 return -ENOMEM;
5788
5789         hci_req_init(&req, hdev);
5790
5791         if (bredr_sc_enabled(hdev))
5792                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
5793         else
5794                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
5795
5796         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
5797         if (err < 0) {
5798                 mgmt_pending_remove(cmd);
5799                 return err;
5800         }
5801
5802         return 0;
5803 }
5804
5805 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
5806                                    void *data, u16 data_len)
5807 {
5808         struct mgmt_cp_read_local_oob_ext_data *cp = data;
5809         struct mgmt_rp_read_local_oob_ext_data *rp;
5810         size_t rp_len;
5811         u16 eir_len;
5812         u8 status, flags, role, addr[7], hash[16], rand[16];
5813         int err;
5814
5815         BT_DBG("%s", hdev->name);
5816
5817         if (hdev_is_powered(hdev)) {
5818                 switch (cp->type) {
5819                 case BIT(BDADDR_BREDR):
5820                         status = mgmt_bredr_support(hdev);
5821                         if (status)
5822                                 eir_len = 0;
5823                         else
5824                                 eir_len = 5;
5825                         break;
5826                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5827                         status = mgmt_le_support(hdev);
5828                         if (status)
5829                                 eir_len = 0;
5830                         else
5831                                 eir_len = 9 + 3 + 18 + 18 + 3;
5832                         break;
5833                 default:
5834                         status = MGMT_STATUS_INVALID_PARAMS;
5835                         eir_len = 0;
5836                         break;
5837                 }
5838         } else {
5839                 status = MGMT_STATUS_NOT_POWERED;
5840                 eir_len = 0;
5841         }
5842
5843         rp_len = sizeof(*rp) + eir_len;
5844         rp = kmalloc(rp_len, GFP_ATOMIC);
5845         if (!rp)
5846                 return -ENOMEM;
5847
5848         if (status)
5849                 goto complete;
5850
5851         hci_dev_lock(hdev);
5852
5853         eir_len = 0;
5854         switch (cp->type) {
5855         case BIT(BDADDR_BREDR):
5856                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5857                         err = read_local_ssp_oob_req(hdev, sk, cp);
5858                         hci_dev_unlock(hdev);
5859                         if (!err)
5860                                 goto done;
5861
5862                         status = MGMT_STATUS_FAILED;
5863                         goto complete;
5864                 } else {
5865                         eir_len = eir_append_data(rp->eir, eir_len,
5866                                                   EIR_CLASS_OF_DEV,
5867                                                   hdev->dev_class, 3);
5868                 }
5869                 break;
5870         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5871                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5872                     smp_generate_oob(hdev, hash, rand) < 0) {
5873                         hci_dev_unlock(hdev);
5874                         status = MGMT_STATUS_FAILED;
5875                         goto complete;
5876                 }
5877
5878                 /* This should return the active RPA, but since the RPA
5879                  * is only programmed on demand, it is really hard to fill
5880                  * this in at the moment. For now disallow retrieving
5881                  * local out-of-band data when privacy is in use.
5882                  *
5883                  * Returning the identity address will not help here since
5884                  * pairing happens before the identity resolving key is
5885                  * known and thus the connection establishment happens
5886                  * based on the RPA and not the identity address.
5887                  */
5888                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5889                         hci_dev_unlock(hdev);
5890                         status = MGMT_STATUS_REJECTED;
5891                         goto complete;
5892                 }
5893
5894                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
5895                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
5896                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5897                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
5898                         memcpy(addr, &hdev->static_addr, 6);
5899                         addr[6] = 0x01;
5900                 } else {
5901                         memcpy(addr, &hdev->bdaddr, 6);
5902                         addr[6] = 0x00;
5903                 }
5904
5905                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
5906                                           addr, sizeof(addr));
5907
5908                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
5909                         role = 0x02;
5910                 else
5911                         role = 0x01;
5912
5913                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
5914                                           &role, sizeof(role));
5915
5916                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
5917                         eir_len = eir_append_data(rp->eir, eir_len,
5918                                                   EIR_LE_SC_CONFIRM,
5919                                                   hash, sizeof(hash));
5920
5921                         eir_len = eir_append_data(rp->eir, eir_len,
5922                                                   EIR_LE_SC_RANDOM,
5923                                                   rand, sizeof(rand));
5924                 }
5925
5926                 flags = mgmt_get_adv_discov_flags(hdev);
5927
5928                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
5929                         flags |= LE_AD_NO_BREDR;
5930
5931                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
5932                                           &flags, sizeof(flags));
5933                 break;
5934         }
5935
5936         hci_dev_unlock(hdev);
5937
5938         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
5939
5940         status = MGMT_STATUS_SUCCESS;
5941
5942 complete:
5943         rp->type = cp->type;
5944         rp->eir_len = cpu_to_le16(eir_len);
5945
5946         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
5947                                 status, rp, sizeof(*rp) + eir_len);
5948         if (err < 0 || status)
5949                 goto done;
5950
5951         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
5952                                  rp, sizeof(*rp) + eir_len,
5953                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
5954
5955 done:
5956         kfree(rp);
5957
5958         return err;
5959 }
5960
5961 static u32 get_supported_adv_flags(struct hci_dev *hdev)
5962 {
5963         u32 flags = 0;
5964
5965         flags |= MGMT_ADV_FLAG_CONNECTABLE;
5966         flags |= MGMT_ADV_FLAG_DISCOV;
5967         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
5968         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
5969         flags |= MGMT_ADV_FLAG_APPEARANCE;
5970         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
5971
5972         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
5973                 flags |= MGMT_ADV_FLAG_TX_POWER;
5974
5975         return flags;
5976 }
5977
5978 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
5979                              void *data, u16 data_len)
5980 {
5981         struct mgmt_rp_read_adv_features *rp;
5982         size_t rp_len;
5983         int err;
5984         struct adv_info *adv_instance;
5985         u32 supported_flags;
5986         u8 *instance;
5987
5988         BT_DBG("%s", hdev->name);
5989
5990         if (!lmp_le_capable(hdev))
5991                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
5992                                        MGMT_STATUS_REJECTED);
5993
5994         hci_dev_lock(hdev);
5995
5996         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
5997         rp = kmalloc(rp_len, GFP_ATOMIC);
5998         if (!rp) {
5999                 hci_dev_unlock(hdev);
6000                 return -ENOMEM;
6001         }
6002
6003         supported_flags = get_supported_adv_flags(hdev);
6004
6005         rp->supported_flags = cpu_to_le32(supported_flags);
6006         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6007         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6008         rp->max_instances = HCI_MAX_ADV_INSTANCES;
6009         rp->num_instances = hdev->adv_instance_cnt;
6010
6011         instance = rp->instance;
6012         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6013                 *instance = adv_instance->instance;
6014                 instance++;
6015         }
6016
6017         hci_dev_unlock(hdev);
6018
6019         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6020                                 MGMT_STATUS_SUCCESS, rp, rp_len);
6021
6022         kfree(rp);
6023
6024         return err;
6025 }
6026
6027 static u8 tlv_data_max_len(u32 adv_flags, bool is_adv_data)
6028 {
6029         u8 max_len = HCI_MAX_AD_LENGTH;
6030
6031         if (is_adv_data) {
6032                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6033                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
6034                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
6035                         max_len -= 3;
6036
6037                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6038                         max_len -= 3;
6039         } else {
6040                 /* at least 1 byte of name should fit in */
6041                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6042                         max_len -= 3;
6043
6044                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6045                         max_len -= 4;
6046         }
6047
6048         return max_len;
6049 }
6050
6051 static bool flags_managed(u32 adv_flags)
6052 {
6053         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6054                             MGMT_ADV_FLAG_LIMITED_DISCOV |
6055                             MGMT_ADV_FLAG_MANAGED_FLAGS);
6056 }
6057
6058 static bool tx_power_managed(u32 adv_flags)
6059 {
6060         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6061 }
6062
6063 static bool name_managed(u32 adv_flags)
6064 {
6065         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6066 }
6067
6068 static bool appearance_managed(u32 adv_flags)
6069 {
6070         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6071 }
6072
6073 static bool tlv_data_is_valid(u32 adv_flags, u8 *data, u8 len, bool is_adv_data)
6074 {
6075         int i, cur_len;
6076         u8 max_len;
6077
6078         max_len = tlv_data_max_len(adv_flags, is_adv_data);
6079
6080         if (len > max_len)
6081                 return false;
6082
6083         /* Make sure that the data is correctly formatted. */
6084         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6085                 cur_len = data[i];
6086
6087                 if (data[i + 1] == EIR_FLAGS &&
6088                     (!is_adv_data || flags_managed(adv_flags)))
6089                         return false;
6090
6091                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6092                         return false;
6093
6094                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6095                         return false;
6096
6097                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6098                         return false;
6099
6100                 if (data[i + 1] == EIR_APPEARANCE &&
6101                     appearance_managed(adv_flags))
6102                         return false;
6103
6104                 /* If the current field length would exceed the total data
6105                  * length, then it's invalid.
6106                  */
6107                 if (i + cur_len >= len)
6108                         return false;
6109         }
6110
6111         return true;
6112 }
6113
6114 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6115                                      u16 opcode)
6116 {
6117         struct mgmt_pending_cmd *cmd;
6118         struct mgmt_cp_add_advertising *cp;
6119         struct mgmt_rp_add_advertising rp;
6120         struct adv_info *adv_instance, *n;
6121         u8 instance;
6122
6123         BT_DBG("status %d", status);
6124
6125         hci_dev_lock(hdev);
6126
6127         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6128
6129         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6130                 if (!adv_instance->pending)
6131                         continue;
6132
6133                 if (!status) {
6134                         adv_instance->pending = false;
6135                         continue;
6136                 }
6137
6138                 instance = adv_instance->instance;
6139
6140                 if (hdev->cur_adv_instance == instance)
6141                         cancel_adv_timeout(hdev);
6142
6143                 hci_remove_adv_instance(hdev, instance);
6144                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6145         }
6146
6147         if (!cmd)
6148                 goto unlock;
6149
6150         cp = cmd->param;
6151         rp.instance = cp->instance;
6152
6153         if (status)
6154                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6155                                 mgmt_status(status));
6156         else
6157                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6158                                   mgmt_status(status), &rp, sizeof(rp));
6159
6160         mgmt_pending_remove(cmd);
6161
6162 unlock:
6163         hci_dev_unlock(hdev);
6164 }
6165
6166 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6167                            void *data, u16 data_len)
6168 {
6169         struct mgmt_cp_add_advertising *cp = data;
6170         struct mgmt_rp_add_advertising rp;
6171         u32 flags;
6172         u32 supported_flags;
6173         u8 status;
6174         u16 timeout, duration;
6175         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6176         u8 schedule_instance = 0;
6177         struct adv_info *next_instance;
6178         int err;
6179         struct mgmt_pending_cmd *cmd;
6180         struct hci_request req;
6181
6182         BT_DBG("%s", hdev->name);
6183
6184         status = mgmt_le_support(hdev);
6185         if (status)
6186                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6187                                        status);
6188
6189         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6190                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6191                                        MGMT_STATUS_INVALID_PARAMS);
6192
6193         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6194                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6195                                        MGMT_STATUS_INVALID_PARAMS);
6196
6197         flags = __le32_to_cpu(cp->flags);
6198         timeout = __le16_to_cpu(cp->timeout);
6199         duration = __le16_to_cpu(cp->duration);
6200
6201         /* The current implementation only supports a subset of the specified
6202          * flags.
6203          */
6204         supported_flags = get_supported_adv_flags(hdev);
6205         if (flags & ~supported_flags)
6206                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6207                                        MGMT_STATUS_INVALID_PARAMS);
6208
6209         hci_dev_lock(hdev);
6210
6211         if (timeout && !hdev_is_powered(hdev)) {
6212                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6213                                       MGMT_STATUS_REJECTED);
6214                 goto unlock;
6215         }
6216
6217         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6218             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6219             pending_find(MGMT_OP_SET_LE, hdev)) {
6220                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6221                                       MGMT_STATUS_BUSY);
6222                 goto unlock;
6223         }
6224
6225         if (!tlv_data_is_valid(flags, cp->data, cp->adv_data_len, true) ||
6226             !tlv_data_is_valid(flags, cp->data + cp->adv_data_len,
6227                                cp->scan_rsp_len, false)) {
6228                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6229                                       MGMT_STATUS_INVALID_PARAMS);
6230                 goto unlock;
6231         }
6232
6233         err = hci_add_adv_instance(hdev, cp->instance, flags,
6234                                    cp->adv_data_len, cp->data,
6235                                    cp->scan_rsp_len,
6236                                    cp->data + cp->adv_data_len,
6237                                    timeout, duration);
6238         if (err < 0) {
6239                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6240                                       MGMT_STATUS_FAILED);
6241                 goto unlock;
6242         }
6243
6244         /* Only trigger an advertising added event if a new instance was
6245          * actually added.
6246          */
6247         if (hdev->adv_instance_cnt > prev_instance_cnt)
6248                 mgmt_advertising_added(sk, hdev, cp->instance);
6249
6250         if (hdev->cur_adv_instance == cp->instance) {
6251                 /* If the currently advertised instance is being changed then
6252                  * cancel the current advertising and schedule the next
6253                  * instance. If there is only one instance then the overridden
6254                  * advertising data will be visible right away.
6255                  */
6256                 cancel_adv_timeout(hdev);
6257
6258                 next_instance = hci_get_next_instance(hdev, cp->instance);
6259                 if (next_instance)
6260                         schedule_instance = next_instance->instance;
6261         } else if (!hdev->adv_instance_timeout) {
6262                 /* Immediately advertise the new instance if no other
6263                  * instance is currently being advertised.
6264                  */
6265                 schedule_instance = cp->instance;
6266         }
6267
6268         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6269          * there is no instance to be advertised then we have no HCI
6270          * communication to make. Simply return.
6271          */
6272         if (!hdev_is_powered(hdev) ||
6273             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6274             !schedule_instance) {
6275                 rp.instance = cp->instance;
6276                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6277                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6278                 goto unlock;
6279         }
6280
6281         /* We're good to go, update advertising data, parameters, and start
6282          * advertising.
6283          */
6284         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6285                                data_len);
6286         if (!cmd) {
6287                 err = -ENOMEM;
6288                 goto unlock;
6289         }
6290
6291         hci_req_init(&req, hdev);
6292
6293         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6294
6295         if (!err)
6296                 err = hci_req_run(&req, add_advertising_complete);
6297
6298         if (err < 0)
6299                 mgmt_pending_remove(cmd);
6300
6301 unlock:
6302         hci_dev_unlock(hdev);
6303
6304         return err;
6305 }
6306
6307 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6308                                         u16 opcode)
6309 {
6310         struct mgmt_pending_cmd *cmd;
6311         struct mgmt_cp_remove_advertising *cp;
6312         struct mgmt_rp_remove_advertising rp;
6313
6314         BT_DBG("status %d", status);
6315
6316         hci_dev_lock(hdev);
6317
6318         /* A failure status here only means that we failed to disable
6319          * advertising. Otherwise, the advertising instance has been removed,
6320          * so report success.
6321          */
6322         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6323         if (!cmd)
6324                 goto unlock;
6325
6326         cp = cmd->param;
6327         rp.instance = cp->instance;
6328
6329         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6330                           &rp, sizeof(rp));
6331         mgmt_pending_remove(cmd);
6332
6333 unlock:
6334         hci_dev_unlock(hdev);
6335 }
6336
6337 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6338                               void *data, u16 data_len)
6339 {
6340         struct mgmt_cp_remove_advertising *cp = data;
6341         struct mgmt_rp_remove_advertising rp;
6342         struct mgmt_pending_cmd *cmd;
6343         struct hci_request req;
6344         int err;
6345
6346         BT_DBG("%s", hdev->name);
6347
6348         hci_dev_lock(hdev);
6349
6350         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6351                 err = mgmt_cmd_status(sk, hdev->id,
6352                                       MGMT_OP_REMOVE_ADVERTISING,
6353                                       MGMT_STATUS_INVALID_PARAMS);
6354                 goto unlock;
6355         }
6356
6357         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6358             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6359             pending_find(MGMT_OP_SET_LE, hdev)) {
6360                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6361                                       MGMT_STATUS_BUSY);
6362                 goto unlock;
6363         }
6364
6365         if (list_empty(&hdev->adv_instances)) {
6366                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6367                                       MGMT_STATUS_INVALID_PARAMS);
6368                 goto unlock;
6369         }
6370
6371         hci_req_init(&req, hdev);
6372
6373         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6374
6375         if (list_empty(&hdev->adv_instances))
6376                 __hci_req_disable_advertising(&req);
6377
6378         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6379          * flag is set or the device isn't powered then we have no HCI
6380          * communication to make. Simply return.
6381          */
6382         if (skb_queue_empty(&req.cmd_q) ||
6383             !hdev_is_powered(hdev) ||
6384             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6385                 rp.instance = cp->instance;
6386                 err = mgmt_cmd_complete(sk, hdev->id,
6387                                         MGMT_OP_REMOVE_ADVERTISING,
6388                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6389                 goto unlock;
6390         }
6391
6392         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6393                                data_len);
6394         if (!cmd) {
6395                 err = -ENOMEM;
6396                 goto unlock;
6397         }
6398
6399         err = hci_req_run(&req, remove_advertising_complete);
6400         if (err < 0)
6401                 mgmt_pending_remove(cmd);
6402
6403 unlock:
6404         hci_dev_unlock(hdev);
6405
6406         return err;
6407 }
6408
6409 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6410                              void *data, u16 data_len)
6411 {
6412         struct mgmt_cp_get_adv_size_info *cp = data;
6413         struct mgmt_rp_get_adv_size_info rp;
6414         u32 flags, supported_flags;
6415         int err;
6416
6417         BT_DBG("%s", hdev->name);
6418
6419         if (!lmp_le_capable(hdev))
6420                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6421                                        MGMT_STATUS_REJECTED);
6422
6423         if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6424                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6425                                        MGMT_STATUS_INVALID_PARAMS);
6426
6427         flags = __le32_to_cpu(cp->flags);
6428
6429         /* The current implementation only supports a subset of the specified
6430          * flags.
6431          */
6432         supported_flags = get_supported_adv_flags(hdev);
6433         if (flags & ~supported_flags)
6434                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6435                                        MGMT_STATUS_INVALID_PARAMS);
6436
6437         rp.instance = cp->instance;
6438         rp.flags = cp->flags;
6439         rp.max_adv_data_len = tlv_data_max_len(flags, true);
6440         rp.max_scan_rsp_len = tlv_data_max_len(flags, false);
6441
6442         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6443                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6444
6445         return err;
6446 }
6447
6448 static const struct hci_mgmt_handler mgmt_handlers[] = {
6449         { NULL }, /* 0x0000 (no command) */
6450         { read_version,            MGMT_READ_VERSION_SIZE,
6451                                                 HCI_MGMT_NO_HDEV |
6452                                                 HCI_MGMT_UNTRUSTED },
6453         { read_commands,           MGMT_READ_COMMANDS_SIZE,
6454                                                 HCI_MGMT_NO_HDEV |
6455                                                 HCI_MGMT_UNTRUSTED },
6456         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
6457                                                 HCI_MGMT_NO_HDEV |
6458                                                 HCI_MGMT_UNTRUSTED },
6459         { read_controller_info,    MGMT_READ_INFO_SIZE,
6460                                                 HCI_MGMT_UNTRUSTED },
6461         { set_powered,             MGMT_SETTING_SIZE },
6462         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
6463         { set_connectable,         MGMT_SETTING_SIZE },
6464         { set_fast_connectable,    MGMT_SETTING_SIZE },
6465         { set_bondable,            MGMT_SETTING_SIZE },
6466         { set_link_security,       MGMT_SETTING_SIZE },
6467         { set_ssp,                 MGMT_SETTING_SIZE },
6468         { set_hs,                  MGMT_SETTING_SIZE },
6469         { set_le,                  MGMT_SETTING_SIZE },
6470         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
6471         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
6472         { add_uuid,                MGMT_ADD_UUID_SIZE },
6473         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
6474         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
6475                                                 HCI_MGMT_VAR_LEN },
6476         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6477                                                 HCI_MGMT_VAR_LEN },
6478         { disconnect,              MGMT_DISCONNECT_SIZE },
6479         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
6480         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
6481         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
6482         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
6483         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
6484         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
6485         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
6486         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
6487         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6488         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
6489         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6490         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
6491         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6492                                                 HCI_MGMT_VAR_LEN },
6493         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6494         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
6495         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
6496         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
6497         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
6498         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
6499         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
6500         { set_advertising,         MGMT_SETTING_SIZE },
6501         { set_bredr,               MGMT_SETTING_SIZE },
6502         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
6503         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
6504         { set_secure_conn,         MGMT_SETTING_SIZE },
6505         { set_debug_keys,          MGMT_SETTING_SIZE },
6506         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
6507         { load_irks,               MGMT_LOAD_IRKS_SIZE,
6508                                                 HCI_MGMT_VAR_LEN },
6509         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
6510         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
6511         { add_device,              MGMT_ADD_DEVICE_SIZE },
6512         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
6513         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
6514                                                 HCI_MGMT_VAR_LEN },
6515         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6516                                                 HCI_MGMT_NO_HDEV |
6517                                                 HCI_MGMT_UNTRUSTED },
6518         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
6519                                                 HCI_MGMT_UNCONFIGURED |
6520                                                 HCI_MGMT_UNTRUSTED },
6521         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
6522                                                 HCI_MGMT_UNCONFIGURED },
6523         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
6524                                                 HCI_MGMT_UNCONFIGURED },
6525         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6526                                                 HCI_MGMT_VAR_LEN },
6527         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6528         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
6529                                                 HCI_MGMT_NO_HDEV |
6530                                                 HCI_MGMT_UNTRUSTED },
6531         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
6532         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
6533                                                 HCI_MGMT_VAR_LEN },
6534         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
6535         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
6536         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6537         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6538                                                 HCI_MGMT_UNTRUSTED },
6539         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
6540 };
6541
6542 void mgmt_index_added(struct hci_dev *hdev)
6543 {
6544         struct mgmt_ev_ext_index ev;
6545
6546         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6547                 return;
6548
6549         switch (hdev->dev_type) {
6550         case HCI_PRIMARY:
6551                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6552                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6553                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6554                         ev.type = 0x01;
6555                 } else {
6556                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6557                                          HCI_MGMT_INDEX_EVENTS);
6558                         ev.type = 0x00;
6559                 }
6560                 break;
6561         case HCI_AMP:
6562                 ev.type = 0x02;
6563                 break;
6564         default:
6565                 return;
6566         }
6567
6568         ev.bus = hdev->bus;
6569
6570         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6571                          HCI_MGMT_EXT_INDEX_EVENTS);
6572 }
6573
6574 void mgmt_index_removed(struct hci_dev *hdev)
6575 {
6576         struct mgmt_ev_ext_index ev;
6577         u8 status = MGMT_STATUS_INVALID_INDEX;
6578
6579         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6580                 return;
6581
6582         switch (hdev->dev_type) {
6583         case HCI_PRIMARY:
6584                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6585
6586                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6587                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6588                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6589                         ev.type = 0x01;
6590                 } else {
6591                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6592                                          HCI_MGMT_INDEX_EVENTS);
6593                         ev.type = 0x00;
6594                 }
6595                 break;
6596         case HCI_AMP:
6597                 ev.type = 0x02;
6598                 break;
6599         default:
6600                 return;
6601         }
6602
6603         ev.bus = hdev->bus;
6604
6605         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6606                          HCI_MGMT_EXT_INDEX_EVENTS);
6607 }
6608
6609 /* This function requires the caller holds hdev->lock */
6610 static void restart_le_actions(struct hci_dev *hdev)
6611 {
6612         struct hci_conn_params *p;
6613
6614         list_for_each_entry(p, &hdev->le_conn_params, list) {
6615                 /* Needed for AUTO_OFF case where might not "really"
6616                  * have been powered off.
6617                  */
6618                 list_del_init(&p->action);
6619
6620                 switch (p->auto_connect) {
6621                 case HCI_AUTO_CONN_DIRECT:
6622                 case HCI_AUTO_CONN_ALWAYS:
6623                         list_add(&p->action, &hdev->pend_le_conns);
6624                         break;
6625                 case HCI_AUTO_CONN_REPORT:
6626                         list_add(&p->action, &hdev->pend_le_reports);
6627                         break;
6628                 default:
6629                         break;
6630                 }
6631         }
6632 }
6633
6634 void mgmt_power_on(struct hci_dev *hdev, int err)
6635 {
6636         struct cmd_lookup match = { NULL, hdev };
6637
6638         BT_DBG("err %d", err);
6639
6640         hci_dev_lock(hdev);
6641
6642         if (!err) {
6643                 restart_le_actions(hdev);
6644                 hci_update_background_scan(hdev);
6645         }
6646
6647         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6648
6649         new_settings(hdev, match.sk);
6650
6651         if (match.sk)
6652                 sock_put(match.sk);
6653
6654         hci_dev_unlock(hdev);
6655 }
6656
6657 void __mgmt_power_off(struct hci_dev *hdev)
6658 {
6659         struct cmd_lookup match = { NULL, hdev };
6660         u8 status, zero_cod[] = { 0, 0, 0 };
6661
6662         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6663
6664         /* If the power off is because of hdev unregistration let
6665          * use the appropriate INVALID_INDEX status. Otherwise use
6666          * NOT_POWERED. We cover both scenarios here since later in
6667          * mgmt_index_removed() any hci_conn callbacks will have already
6668          * been triggered, potentially causing misleading DISCONNECTED
6669          * status responses.
6670          */
6671         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
6672                 status = MGMT_STATUS_INVALID_INDEX;
6673         else
6674                 status = MGMT_STATUS_NOT_POWERED;
6675
6676         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6677
6678         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
6679                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6680                                    zero_cod, sizeof(zero_cod),
6681                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
6682                 ext_info_changed(hdev, NULL);
6683         }
6684
6685         new_settings(hdev, match.sk);
6686
6687         if (match.sk)
6688                 sock_put(match.sk);
6689 }
6690
6691 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6692 {
6693         struct mgmt_pending_cmd *cmd;
6694         u8 status;
6695
6696         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
6697         if (!cmd)
6698                 return;
6699
6700         if (err == -ERFKILL)
6701                 status = MGMT_STATUS_RFKILLED;
6702         else
6703                 status = MGMT_STATUS_FAILED;
6704
6705         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6706
6707         mgmt_pending_remove(cmd);
6708 }
6709
6710 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6711                        bool persistent)
6712 {
6713         struct mgmt_ev_new_link_key ev;
6714
6715         memset(&ev, 0, sizeof(ev));
6716
6717         ev.store_hint = persistent;
6718         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6719         ev.key.addr.type = BDADDR_BREDR;
6720         ev.key.type = key->type;
6721         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6722         ev.key.pin_len = key->pin_len;
6723
6724         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6725 }
6726
6727 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6728 {
6729         switch (ltk->type) {
6730         case SMP_LTK:
6731         case SMP_LTK_SLAVE:
6732                 if (ltk->authenticated)
6733                         return MGMT_LTK_AUTHENTICATED;
6734                 return MGMT_LTK_UNAUTHENTICATED;
6735         case SMP_LTK_P256:
6736                 if (ltk->authenticated)
6737                         return MGMT_LTK_P256_AUTH;
6738                 return MGMT_LTK_P256_UNAUTH;
6739         case SMP_LTK_P256_DEBUG:
6740                 return MGMT_LTK_P256_DEBUG;
6741         }
6742
6743         return MGMT_LTK_UNAUTHENTICATED;
6744 }
6745
6746 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6747 {
6748         struct mgmt_ev_new_long_term_key ev;
6749
6750         memset(&ev, 0, sizeof(ev));
6751
6752         /* Devices using resolvable or non-resolvable random addresses
6753          * without providing an identity resolving key don't require
6754          * to store long term keys. Their addresses will change the
6755          * next time around.
6756          *
6757          * Only when a remote device provides an identity address
6758          * make sure the long term key is stored. If the remote
6759          * identity is known, the long term keys are internally
6760          * mapped to the identity address. So allow static random
6761          * and public addresses here.
6762          */
6763         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6764             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6765                 ev.store_hint = 0x00;
6766         else
6767                 ev.store_hint = persistent;
6768
6769         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6770         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6771         ev.key.type = mgmt_ltk_type(key);
6772         ev.key.enc_size = key->enc_size;
6773         ev.key.ediv = key->ediv;
6774         ev.key.rand = key->rand;
6775
6776         if (key->type == SMP_LTK)
6777                 ev.key.master = 1;
6778
6779         /* Make sure we copy only the significant bytes based on the
6780          * encryption key size, and set the rest of the value to zeroes.
6781          */
6782         memcpy(ev.key.val, key->val, key->enc_size);
6783         memset(ev.key.val + key->enc_size, 0,
6784                sizeof(ev.key.val) - key->enc_size);
6785
6786         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6787 }
6788
6789 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
6790 {
6791         struct mgmt_ev_new_irk ev;
6792
6793         memset(&ev, 0, sizeof(ev));
6794
6795         ev.store_hint = persistent;
6796
6797         bacpy(&ev.rpa, &irk->rpa);
6798         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6799         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6800         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6801
6802         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6803 }
6804
6805 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6806                    bool persistent)
6807 {
6808         struct mgmt_ev_new_csrk ev;
6809
6810         memset(&ev, 0, sizeof(ev));
6811
6812         /* Devices using resolvable or non-resolvable random addresses
6813          * without providing an identity resolving key don't require
6814          * to store signature resolving keys. Their addresses will change
6815          * the next time around.
6816          *
6817          * Only when a remote device provides an identity address
6818          * make sure the signature resolving key is stored. So allow
6819          * static random and public addresses here.
6820          */
6821         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6822             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6823                 ev.store_hint = 0x00;
6824         else
6825                 ev.store_hint = persistent;
6826
6827         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6828         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6829         ev.key.type = csrk->type;
6830         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6831
6832         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6833 }
6834
6835 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6836                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6837                          u16 max_interval, u16 latency, u16 timeout)
6838 {
6839         struct mgmt_ev_new_conn_param ev;
6840
6841         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6842                 return;
6843
6844         memset(&ev, 0, sizeof(ev));
6845         bacpy(&ev.addr.bdaddr, bdaddr);
6846         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6847         ev.store_hint = store_hint;
6848         ev.min_interval = cpu_to_le16(min_interval);
6849         ev.max_interval = cpu_to_le16(max_interval);
6850         ev.latency = cpu_to_le16(latency);
6851         ev.timeout = cpu_to_le16(timeout);
6852
6853         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6854 }
6855
6856 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6857                            u32 flags, u8 *name, u8 name_len)
6858 {
6859         char buf[512];
6860         struct mgmt_ev_device_connected *ev = (void *) buf;
6861         u16 eir_len = 0;
6862
6863         bacpy(&ev->addr.bdaddr, &conn->dst);
6864         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6865
6866         ev->flags = __cpu_to_le32(flags);
6867
6868         /* We must ensure that the EIR Data fields are ordered and
6869          * unique. Keep it simple for now and avoid the problem by not
6870          * adding any BR/EDR data to the LE adv.
6871          */
6872         if (conn->le_adv_data_len > 0) {
6873                 memcpy(&ev->eir[eir_len],
6874                        conn->le_adv_data, conn->le_adv_data_len);
6875                 eir_len = conn->le_adv_data_len;
6876         } else {
6877                 if (name_len > 0)
6878                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6879                                                   name, name_len);
6880
6881                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6882                         eir_len = eir_append_data(ev->eir, eir_len,
6883                                                   EIR_CLASS_OF_DEV,
6884                                                   conn->dev_class, 3);
6885         }
6886
6887         ev->eir_len = cpu_to_le16(eir_len);
6888
6889         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6890                     sizeof(*ev) + eir_len, NULL);
6891 }
6892
6893 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
6894 {
6895         struct sock **sk = data;
6896
6897         cmd->cmd_complete(cmd, 0);
6898
6899         *sk = cmd->sk;
6900         sock_hold(*sk);
6901
6902         mgmt_pending_remove(cmd);
6903 }
6904
6905 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
6906 {
6907         struct hci_dev *hdev = data;
6908         struct mgmt_cp_unpair_device *cp = cmd->param;
6909
6910         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6911
6912         cmd->cmd_complete(cmd, 0);
6913         mgmt_pending_remove(cmd);
6914 }
6915
6916 bool mgmt_powering_down(struct hci_dev *hdev)
6917 {
6918         struct mgmt_pending_cmd *cmd;
6919         struct mgmt_mode *cp;
6920
6921         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
6922         if (!cmd)
6923                 return false;
6924
6925         cp = cmd->param;
6926         if (!cp->val)
6927                 return true;
6928
6929         return false;
6930 }
6931
6932 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6933                               u8 link_type, u8 addr_type, u8 reason,
6934                               bool mgmt_connected)
6935 {
6936         struct mgmt_ev_device_disconnected ev;
6937         struct sock *sk = NULL;
6938
6939         /* The connection is still in hci_conn_hash so test for 1
6940          * instead of 0 to know if this is the last one.
6941          */
6942         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6943                 cancel_delayed_work(&hdev->power_off);
6944                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6945         }
6946
6947         if (!mgmt_connected)
6948                 return;
6949
6950         if (link_type != ACL_LINK && link_type != LE_LINK)
6951                 return;
6952
6953         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6954
6955         bacpy(&ev.addr.bdaddr, bdaddr);
6956         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6957         ev.reason = reason;
6958
6959         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6960
6961         if (sk)
6962                 sock_put(sk);
6963
6964         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6965                              hdev);
6966 }
6967
6968 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6969                             u8 link_type, u8 addr_type, u8 status)
6970 {
6971         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6972         struct mgmt_cp_disconnect *cp;
6973         struct mgmt_pending_cmd *cmd;
6974
6975         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6976                              hdev);
6977
6978         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
6979         if (!cmd)
6980                 return;
6981
6982         cp = cmd->param;
6983
6984         if (bacmp(bdaddr, &cp->addr.bdaddr))
6985                 return;
6986
6987         if (cp->addr.type != bdaddr_type)
6988                 return;
6989
6990         cmd->cmd_complete(cmd, mgmt_status(status));
6991         mgmt_pending_remove(cmd);
6992 }
6993
6994 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6995                          u8 addr_type, u8 status)
6996 {
6997         struct mgmt_ev_connect_failed ev;
6998
6999         /* The connection is still in hci_conn_hash so test for 1
7000          * instead of 0 to know if this is the last one.
7001          */
7002         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7003                 cancel_delayed_work(&hdev->power_off);
7004                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7005         }
7006
7007         bacpy(&ev.addr.bdaddr, bdaddr);
7008         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7009         ev.status = mgmt_status(status);
7010
7011         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7012 }
7013
7014 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7015 {
7016         struct mgmt_ev_pin_code_request ev;
7017
7018         bacpy(&ev.addr.bdaddr, bdaddr);
7019         ev.addr.type = BDADDR_BREDR;
7020         ev.secure = secure;
7021
7022         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7023 }
7024
7025 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7026                                   u8 status)
7027 {
7028         struct mgmt_pending_cmd *cmd;
7029
7030         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7031         if (!cmd)
7032                 return;
7033
7034         cmd->cmd_complete(cmd, mgmt_status(status));
7035         mgmt_pending_remove(cmd);
7036 }
7037
7038 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7039                                       u8 status)
7040 {
7041         struct mgmt_pending_cmd *cmd;
7042
7043         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7044         if (!cmd)
7045                 return;
7046
7047         cmd->cmd_complete(cmd, mgmt_status(status));
7048         mgmt_pending_remove(cmd);
7049 }
7050
7051 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7052                               u8 link_type, u8 addr_type, u32 value,
7053                               u8 confirm_hint)
7054 {
7055         struct mgmt_ev_user_confirm_request ev;
7056
7057         BT_DBG("%s", hdev->name);
7058
7059         bacpy(&ev.addr.bdaddr, bdaddr);
7060         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7061         ev.confirm_hint = confirm_hint;
7062         ev.value = cpu_to_le32(value);
7063
7064         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7065                           NULL);
7066 }
7067
7068 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7069                               u8 link_type, u8 addr_type)
7070 {
7071         struct mgmt_ev_user_passkey_request ev;
7072
7073         BT_DBG("%s", hdev->name);
7074
7075         bacpy(&ev.addr.bdaddr, bdaddr);
7076         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7077
7078         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7079                           NULL);
7080 }
7081
7082 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7083                                       u8 link_type, u8 addr_type, u8 status,
7084                                       u8 opcode)
7085 {
7086         struct mgmt_pending_cmd *cmd;
7087
7088         cmd = pending_find(opcode, hdev);
7089         if (!cmd)
7090                 return -ENOENT;
7091
7092         cmd->cmd_complete(cmd, mgmt_status(status));
7093         mgmt_pending_remove(cmd);
7094
7095         return 0;
7096 }
7097
7098 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7099                                      u8 link_type, u8 addr_type, u8 status)
7100 {
7101         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7102                                           status, MGMT_OP_USER_CONFIRM_REPLY);
7103 }
7104
7105 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7106                                          u8 link_type, u8 addr_type, u8 status)
7107 {
7108         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7109                                           status,
7110                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
7111 }
7112
7113 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7114                                      u8 link_type, u8 addr_type, u8 status)
7115 {
7116         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7117                                           status, MGMT_OP_USER_PASSKEY_REPLY);
7118 }
7119
7120 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7121                                          u8 link_type, u8 addr_type, u8 status)
7122 {
7123         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7124                                           status,
7125                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
7126 }
7127
7128 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7129                              u8 link_type, u8 addr_type, u32 passkey,
7130                              u8 entered)
7131 {
7132         struct mgmt_ev_passkey_notify ev;
7133
7134         BT_DBG("%s", hdev->name);
7135
7136         bacpy(&ev.addr.bdaddr, bdaddr);
7137         ev.addr.type = link_to_bdaddr(link_type, addr_type);
7138         ev.passkey = __cpu_to_le32(passkey);
7139         ev.entered = entered;
7140
7141         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7142 }
7143
7144 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7145 {
7146         struct mgmt_ev_auth_failed ev;
7147         struct mgmt_pending_cmd *cmd;
7148         u8 status = mgmt_status(hci_status);
7149
7150         bacpy(&ev.addr.bdaddr, &conn->dst);
7151         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7152         ev.status = status;
7153
7154         cmd = find_pairing(conn);
7155
7156         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7157                     cmd ? cmd->sk : NULL);
7158
7159         if (cmd) {
7160                 cmd->cmd_complete(cmd, status);
7161                 mgmt_pending_remove(cmd);
7162         }
7163 }
7164
7165 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7166 {
7167         struct cmd_lookup match = { NULL, hdev };
7168         bool changed;
7169
7170         if (status) {
7171                 u8 mgmt_err = mgmt_status(status);
7172                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7173                                      cmd_status_rsp, &mgmt_err);
7174                 return;
7175         }
7176
7177         if (test_bit(HCI_AUTH, &hdev->flags))
7178                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7179         else
7180                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7181
7182         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7183                              &match);
7184
7185         if (changed)
7186                 new_settings(hdev, match.sk);
7187
7188         if (match.sk)
7189                 sock_put(match.sk);
7190 }
7191
7192 static void clear_eir(struct hci_request *req)
7193 {
7194         struct hci_dev *hdev = req->hdev;
7195         struct hci_cp_write_eir cp;
7196
7197         if (!lmp_ext_inq_capable(hdev))
7198                 return;
7199
7200         memset(hdev->eir, 0, sizeof(hdev->eir));
7201
7202         memset(&cp, 0, sizeof(cp));
7203
7204         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7205 }
7206
7207 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7208 {
7209         struct cmd_lookup match = { NULL, hdev };
7210         struct hci_request req;
7211         bool changed = false;
7212
7213         if (status) {
7214                 u8 mgmt_err = mgmt_status(status);
7215
7216                 if (enable && hci_dev_test_and_clear_flag(hdev,
7217                                                           HCI_SSP_ENABLED)) {
7218                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7219                         new_settings(hdev, NULL);
7220                 }
7221
7222                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7223                                      &mgmt_err);
7224                 return;
7225         }
7226
7227         if (enable) {
7228                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7229         } else {
7230                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7231                 if (!changed)
7232                         changed = hci_dev_test_and_clear_flag(hdev,
7233                                                               HCI_HS_ENABLED);
7234                 else
7235                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7236         }
7237
7238         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7239
7240         if (changed)
7241                 new_settings(hdev, match.sk);
7242
7243         if (match.sk)
7244                 sock_put(match.sk);
7245
7246         hci_req_init(&req, hdev);
7247
7248         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7249                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7250                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7251                                     sizeof(enable), &enable);
7252                 __hci_req_update_eir(&req);
7253         } else {
7254                 clear_eir(&req);
7255         }
7256
7257         hci_req_run(&req, NULL);
7258 }
7259
7260 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7261 {
7262         struct cmd_lookup *match = data;
7263
7264         if (match->sk == NULL) {
7265                 match->sk = cmd->sk;
7266                 sock_hold(match->sk);
7267         }
7268 }
7269
7270 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7271                                     u8 status)
7272 {
7273         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7274
7275         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7276         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7277         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7278
7279         if (!status) {
7280                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7281                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7282                 ext_info_changed(hdev, NULL);
7283         }
7284
7285         if (match.sk)
7286                 sock_put(match.sk);
7287 }
7288
7289 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7290 {
7291         struct mgmt_cp_set_local_name ev;
7292         struct mgmt_pending_cmd *cmd;
7293
7294         if (status)
7295                 return;
7296
7297         memset(&ev, 0, sizeof(ev));
7298         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7299         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7300
7301         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7302         if (!cmd) {
7303                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7304
7305                 /* If this is a HCI command related to powering on the
7306                  * HCI dev don't send any mgmt signals.
7307                  */
7308                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7309                         return;
7310         }
7311
7312         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7313                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7314         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7315 }
7316
7317 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7318 {
7319         int i;
7320
7321         for (i = 0; i < uuid_count; i++) {
7322                 if (!memcmp(uuid, uuids[i], 16))
7323                         return true;
7324         }
7325
7326         return false;
7327 }
7328
7329 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7330 {
7331         u16 parsed = 0;
7332
7333         while (parsed < eir_len) {
7334                 u8 field_len = eir[0];
7335                 u8 uuid[16];
7336                 int i;
7337
7338                 if (field_len == 0)
7339                         break;
7340
7341                 if (eir_len - parsed < field_len + 1)
7342                         break;
7343
7344                 switch (eir[1]) {
7345                 case EIR_UUID16_ALL:
7346                 case EIR_UUID16_SOME:
7347                         for (i = 0; i + 3 <= field_len; i += 2) {
7348                                 memcpy(uuid, bluetooth_base_uuid, 16);
7349                                 uuid[13] = eir[i + 3];
7350                                 uuid[12] = eir[i + 2];
7351                                 if (has_uuid(uuid, uuid_count, uuids))
7352                                         return true;
7353                         }
7354                         break;
7355                 case EIR_UUID32_ALL:
7356                 case EIR_UUID32_SOME:
7357                         for (i = 0; i + 5 <= field_len; i += 4) {
7358                                 memcpy(uuid, bluetooth_base_uuid, 16);
7359                                 uuid[15] = eir[i + 5];
7360                                 uuid[14] = eir[i + 4];
7361                                 uuid[13] = eir[i + 3];
7362                                 uuid[12] = eir[i + 2];
7363                                 if (has_uuid(uuid, uuid_count, uuids))
7364                                         return true;
7365                         }
7366                         break;
7367                 case EIR_UUID128_ALL:
7368                 case EIR_UUID128_SOME:
7369                         for (i = 0; i + 17 <= field_len; i += 16) {
7370                                 memcpy(uuid, eir + i + 2, 16);
7371                                 if (has_uuid(uuid, uuid_count, uuids))
7372                                         return true;
7373                         }
7374                         break;
7375                 }
7376
7377                 parsed += field_len + 1;
7378                 eir += field_len + 1;
7379         }
7380
7381         return false;
7382 }
7383
7384 static void restart_le_scan(struct hci_dev *hdev)
7385 {
7386         /* If controller is not scanning we are done. */
7387         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7388                 return;
7389
7390         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7391                        hdev->discovery.scan_start +
7392                        hdev->discovery.scan_duration))
7393                 return;
7394
7395         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7396                            DISCOV_LE_RESTART_DELAY);
7397 }
7398
7399 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7400                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7401 {
7402         /* If a RSSI threshold has been specified, and
7403          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7404          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7405          * is set, let it through for further processing, as we might need to
7406          * restart the scan.
7407          *
7408          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7409          * the results are also dropped.
7410          */
7411         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7412             (rssi == HCI_RSSI_INVALID ||
7413             (rssi < hdev->discovery.rssi &&
7414              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7415                 return  false;
7416
7417         if (hdev->discovery.uuid_count != 0) {
7418                 /* If a list of UUIDs is provided in filter, results with no
7419                  * matching UUID should be dropped.
7420                  */
7421                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7422                                    hdev->discovery.uuids) &&
7423                     !eir_has_uuids(scan_rsp, scan_rsp_len,
7424                                    hdev->discovery.uuid_count,
7425                                    hdev->discovery.uuids))
7426                         return false;
7427         }
7428
7429         /* If duplicate filtering does not report RSSI changes, then restart
7430          * scanning to ensure updated result with updated RSSI values.
7431          */
7432         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7433                 restart_le_scan(hdev);
7434
7435                 /* Validate RSSI value against the RSSI threshold once more. */
7436                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7437                     rssi < hdev->discovery.rssi)
7438                         return false;
7439         }
7440
7441         return true;
7442 }
7443
7444 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7445                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7446                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7447 {
7448         char buf[512];
7449         struct mgmt_ev_device_found *ev = (void *)buf;
7450         size_t ev_size;
7451
7452         /* Don't send events for a non-kernel initiated discovery. With
7453          * LE one exception is if we have pend_le_reports > 0 in which
7454          * case we're doing passive scanning and want these events.
7455          */
7456         if (!hci_discovery_active(hdev)) {
7457                 if (link_type == ACL_LINK)
7458                         return;
7459                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7460                         return;
7461         }
7462
7463         if (hdev->discovery.result_filtering) {
7464                 /* We are using service discovery */
7465                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7466                                      scan_rsp_len))
7467                         return;
7468         }
7469
7470         if (hdev->discovery.limited) {
7471                 /* Check for limited discoverable bit */
7472                 if (dev_class) {
7473                         if (!(dev_class[1] & 0x20))
7474                                 return;
7475                 } else {
7476                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7477                         if (!flags || !(flags[0] & LE_AD_LIMITED))
7478                                 return;
7479                 }
7480         }
7481
7482         /* Make sure that the buffer is big enough. The 5 extra bytes
7483          * are for the potential CoD field.
7484          */
7485         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7486                 return;
7487
7488         memset(buf, 0, sizeof(buf));
7489
7490         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7491          * RSSI value was reported as 0 when not available. This behavior
7492          * is kept when using device discovery. This is required for full
7493          * backwards compatibility with the API.
7494          *
7495          * However when using service discovery, the value 127 will be
7496          * returned when the RSSI is not available.
7497          */
7498         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7499             link_type == ACL_LINK)
7500                 rssi = 0;
7501
7502         bacpy(&ev->addr.bdaddr, bdaddr);
7503         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7504         ev->rssi = rssi;
7505         ev->flags = cpu_to_le32(flags);
7506
7507         if (eir_len > 0)
7508                 /* Copy EIR or advertising data into event */
7509                 memcpy(ev->eir, eir, eir_len);
7510
7511         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7512                                        NULL))
7513                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7514                                           dev_class, 3);
7515
7516         if (scan_rsp_len > 0)
7517                 /* Append scan response data to event */
7518                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7519
7520         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7521         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7522
7523         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7524 }
7525
7526 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7527                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7528 {
7529         struct mgmt_ev_device_found *ev;
7530         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7531         u16 eir_len;
7532
7533         ev = (struct mgmt_ev_device_found *) buf;
7534
7535         memset(buf, 0, sizeof(buf));
7536
7537         bacpy(&ev->addr.bdaddr, bdaddr);
7538         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7539         ev->rssi = rssi;
7540
7541         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7542                                   name_len);
7543
7544         ev->eir_len = cpu_to_le16(eir_len);
7545
7546         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7547 }
7548
7549 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7550 {
7551         struct mgmt_ev_discovering ev;
7552
7553         BT_DBG("%s discovering %u", hdev->name, discovering);
7554
7555         memset(&ev, 0, sizeof(ev));
7556         ev.type = hdev->discovery.type;
7557         ev.discovering = discovering;
7558
7559         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7560 }
7561
7562 static struct hci_mgmt_chan chan = {
7563         .channel        = HCI_CHANNEL_CONTROL,
7564         .handler_count  = ARRAY_SIZE(mgmt_handlers),
7565         .handlers       = mgmt_handlers,
7566         .hdev_init      = mgmt_init_hdev,
7567 };
7568
7569 int mgmt_init(void)
7570 {
7571         return hci_mgmt_chan_register(&chan);
7572 }
7573
7574 void mgmt_exit(void)
7575 {
7576         hci_mgmt_chan_unregister(&chan);
7577 }